TruffleHog vs Trivy

Free tier available

Free and open source

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Free and open source. You pay in engineering time and CI minutes.

Open-source CLI is free and fully functional including verification.

Everything, self-hosted

Widely used

Truffle Security · since 2016

Category standard

Aqua Security · since 2019

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Free and covers container, IaC, secret and dependency scanning in one binary.
• Fast enough to run on every image build without slowing the pipeline.
• Excellent Kubernetes integration through the Trivy Operator.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

• No hosted dashboard or workflow — findings go to your pipeline output.
• No reachability analysis, so alert volume is high on large images.
• Reporting for compliance requires building it yourself.

Teams that want free, high-signal secret scanning in the pipeline today.

Container and Kubernetes pipelines that need free, comprehensive scanning.