> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/external-scanners.md).

# External scanner support

Some scans of your software are run by parties you do not control: a customer running their own SBOM check against an image you shipped, a regulator running an audit scan, a security team inside a partner organization. They cannot read the Seal Platform, and they will not be configured with credentials that let Seal update their dashboards.

For those scans, the integration is on the **scanner's** side: the scanner consumes Seal's published vulnerability data and recognizes sealed packages as remediated.

Two artifacts make this work, and both are publicly available:

* The **Seal vulnerability feed**: a continuously updated dataset listing every sealed package version and the vulnerabilities each one resolves.
* **VEX records**: per-sealed-package Vulnerability Exploitability eXchange records that scanners can attach to an SBOM to mark each remediated vulnerability as fixed.

## When this applies

This chapter is for the scans you cannot drive from your CI. The Seal CLI is not involved; no specific Seal deployment method is required on your side. Whether you run the Seal CLI in **Remote**, **Local**, or **all** mode, or use the Seal Artifact Server as a remote, the feed and the VEX records are produced by the Seal Platform for every sealed package and are equally available.

## Scanners that consume the feed today

* **Trivy** (Aqua Security): recognizes every sealed package Seal publishes, across every ecosystem, regardless of whether the package is renamed. No configuration on the customer side.
* **Wiz**: recognizes sealed OS packages today. Application-layer ecosystems are not covered yet. No configuration on the customer side.

For scanners not on this list, the customer-side strategy is [Package renaming](/integrations/package-renaming.md), which avoids the external scanner's false positives by changing what the scanner sees in the manifest.

## In this chapter

* [The Seal vulnerability feed](/integrations/external-scanners/vulnerability-feed.md): what the feed contains and how scanners consume it.
* [VEX records](/integrations/external-scanners/vex-records.md): per-package machine-readable remediation records.
* [Trivy](/integrations/external-scanners/trivy.md): coverage details.
* [Wiz](/integrations/external-scanners/wiz.md): coverage details.

## Related

* [Internal scanner integrations](/integrations/internal-scanners.md): for scanners your organization runs and can be configured against the Seal CLI.
* [Package renaming](/integrations/package-renaming.md): the customer-side strategy for scanners outside the feed.