> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/external-scanners/trivy.md).

# Trivy

<figure><img src="/files/lrjpYxrJDVk943g0jLBa" alt="Trivy" width="200"><figcaption></figcaption></figure>

Aqua Security's Trivy is a widely used open-source vulnerability scanner that runs against filesystems, container images, and SBOMs. Trivy natively consumes the Seal vulnerability feed; sealed packages are recognized as remediated out of the box.

## Coverage

Trivy recognizes every sealed package across every Seal-supported ecosystem, whether the package is installed under its original name or under the `seal-`-prefixed name produced by [Package renaming](/integrations/package-renaming.md). No special configuration on Trivy's side is needed for either case.

## Customer-side setup

None. Run Trivy as you normally would; sealed packages are scored from the feed.

## Relationship to VEX records

For SBOMs you produce yourself, attaching [VEX records](/integrations/external-scanners/vex-records.md) per artifact remains a clean way to ship remediation evidence inline with the SBOM. Trivy honors VEX statements bundled with an SBOM where applicable; this complements but does not replace the feed-side recognition.

## Related

* [The Seal vulnerability feed](/integrations/external-scanners/vulnerability-feed.md)
* [VEX records](/integrations/external-scanners/vex-records.md)
* [Wiz](/integrations/external-scanners/wiz.md)