> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/external-scanners.md).

# External scanner support

How Seal makes its remediation visible to scanners run outside your organization, by customers, regulators, or other external parties.

Some scans of your software are run by parties you do not control: a customer running their own SBOM check against an image you shipped, a regulator running an audit scan, a security team inside a partner organization. They cannot read the Seal Platform, and they will not be configured with credentials that let Seal update their dashboards.

For those scans, the integration is on the **scanner's** side: the scanner consumes Seal's published vulnerability data and recognizes sealed packages as remediated.

Two artifacts make this work, and both are publicly available:

* The **Seal vulnerability feed**: a continuously updated dataset listing every sealed package version and the vulnerabilities each one resolves.
* **VEX records**: per-sealed-package Vulnerability Exploitability eXchange records that scanners can attach to an SBOM to mark each remediated vulnerability as fixed.

## When this applies

This chapter is for the scans you cannot drive from your CI. The Seal CLI is not involved; no specific Seal deployment method is required on your side. Whether you run the Seal CLI in **Remote**, **Local**, or **all** mode, or use the Seal Artifact Server as a remote, the feed and the VEX records are produced by the Seal Platform for every sealed package and are equally available.

## Scanners that consume the feed today

* **Trivy** (Aqua Security): recognizes every sealed package Seal publishes, across every ecosystem, regardless of whether the package is renamed. No configuration on the customer side.
* **Wiz**: recognizes sealed OS packages today. Application-layer ecosystems are not covered yet. No configuration on the customer side.

For scanners not on this list, the customer-side strategy is [Package renaming](/integrations/package-renaming.md), which avoids the external scanner's false positives by changing what the scanner sees in the manifest.

## In this chapter

* [The Seal vulnerability feed](/integrations/external-scanners/vulnerability-feed.md): what the feed contains and how scanners consume it.
* [VEX records](/integrations/external-scanners/vex-records.md): per-package machine-readable remediation records.
* [Trivy](/integrations/external-scanners/trivy.md): coverage details.
* [Wiz](/integrations/external-scanners/wiz.md): coverage details.

## Related

* [Internal scanner integrations](/integrations/internal-scanners.md): for scanners your organization runs and can be configured against the Seal CLI.
* [Package renaming](/integrations/package-renaming.md): the customer-side strategy for scanners outside the feed.