Prowler vs Trivy: What Each Scans and How Prowler Uses Trivy

Prowler uses Trivy. Its IaC and container image providers run the Trivy binary and turn its results into Prowler findings. Trivy, from Aqua Security, scans artifacts: images, filesystems, repositories and Kubernetes clusters. Prowler's main job is scanning cloud and SaaS accounts through their APIs. Facts below come from Prowler's source at tag 5.45.0 and the Trivy repository, checked October 23, 2026 (Prowler, Trivy).

Quick answer

Sources: Prowler IaC provider, Prowler image provider, Trivy README, Trivy docs and Trivy compliance guide, checked October 23, 2026.

Verdict: use Trivy for what you build (images, dependencies, IaC) and Prowler for where you run it (cloud accounts). If you already run Prowler, its IaC and image providers give you Trivy's results in Prowler's output formats, but Trivy on its own has more targets and options.

How Prowler uses Trivy

At tag 5.45.0, Prowler's iac provider builds a trivy fs command against a local folder or a cloned Git repository, parses Trivy's JSON output and converts each result into a Prowler finding (iac_provider.py). The image provider does the same with trivy image, and its docstring describes it as "a Tool/Wrapper provider that delegates all scanning logic to Trivy" (image_provider.py).

The Prowler container image ships Trivy 0.75.0 at 5.45.0, pinned by version and checksum in the Dockerfile. If you install Prowler with pip, you install Trivy yourself; Prowler raises an error pointing to the Trivy install docs when the binary is missing.

The wrapper gives you findings in Prowler's CSV, JSON-OCSF and HTML formats (plus SARIF for IaC), registry scanning with image and tag filters, and, in the self-hosted web app, IaC and image findings next to your cloud findings. It adds no rules of its own; the detection is Trivy's.

What Trivy does that Prowler does not

• Scans root filesystems, VM images and SBOMs, and runs inside clusters through the Trivy Operator.
• Generates SBOMs in CycloneDX and SPDX formats.
• Offers every Trivy flag directly. Prowler exposes a subset: scanners, severity filter, ignore-unfixed and timeout.
• Runs in client/server mode, with a shared vulnerability database for many CI runners.

What Prowler does that Trivy does not

Prowler checks account-level posture, meaning settings that live in no artifact: whether root has MFA, whether CloudTrail is on in every region, which security groups allow 0.0.0.0/0 on SSH, whether Entra ID blocks legacy authentication, how GitHub branch protection is set. It maps those findings to CIS, SOC 2, ISO 27001, PCI DSS, NIS2, DORA and more than 100 other frameworks.

Trivy's current docs list no cloud target, and AWS scanning is in the separate trivy-aws plugin, which covers misconfigurations only. For multi-cloud posture and compliance reporting, Prowler is the stronger tool.

Running each one

Trivy on an image, a repository folder and an IaC folder:

brew install trivy
trivy image --severity CRITICAL,HIGH python:3.12-slim
trivy fs --scanners vuln,secret,misconfig .
trivy config ./infra

The same scans through Prowler, with Trivy on the PATH or using the prowlercloud/prowler container image:

pip install prowler
prowler image --image python:3.12-slim --trivy-severity CRITICAL HIGH
prowler iac --scan-path . --scanners vuln secret misconfig

And the part Trivy's main CLI does not cover, a CIS AWS Foundations 7.0 scan of a live account:

prowler aws --compliance cis_7.0_aws

To scan a whole registry, Prowler enumerates repositories and tags and filters them with regular expressions before handing each image to Trivy. --registry-list shows what it would scan without scanning:

prowler image --registry 123456789012.dkr.ecr.us-east-1.amazonaws.com --registry-list
prowler image --registry 123456789012.dkr.ecr.us-east-1.amazonaws.com --image-filter '^prod/' --tag-filter '^v[0-9]+' --ignore-unfixed

Versions and upkeep

Prowler pins the Trivy version in its container image, so it can trail upstream. Prowler 5.45.0 shipped Trivy 0.75.0 on October 15, 2026, while Trivy 0.76.0 came out on October 14 and 0.76.1 on October 21 (Trivy releases). Vulnerability data is downloaded by Trivy at scan time, so CVE coverage stays current; new scanner features and misconfiguration rules arrive when Prowler bumps the pin. If you need a specific Trivy version, run Trivy directly or install Prowler with pip next to the Trivy build you want.

Using both

A common split: Trivy in CI on every image build and pull request, failing the build on critical CVEs and IaC errors; Prowler on a daily schedule against every cloud account, feeding compliance reports and a findings backlog. If you want image findings in the same place as account findings, point Prowler's image provider at your registry. Otherwise keep Trivy where it is fastest, in the pipeline.

The Prowler half is the one that needs a server, a database and upgrades. Kevra Security runs the open-source Prowler web app for you from USD 49 per month, with unlimited cloud accounts.

Related: Prowler vs Checkov, Prowler vs Steampipe, open-source CSPM tools compared.

FAQ

Does Prowler use Trivy?

Yes. Prowler's IaC provider runs trivy fs and its container image provider runs trivy image, then converts the results into Prowler findings. The Prowler container image bundles Trivy; with pip you install Trivy yourself.

Can Trivy scan an AWS account?

Trivy's current docs list no cloud account target. AWS misconfiguration scanning is available through the separate trivy-aws plugin. Prowler covers AWS and other clouds natively, with compliance framework mapping.

Is Trivy open source?

Yes. Trivy is an Aqua Security open source project licensed under Apache-2.0. Prowler is also Apache-2.0.

Should I use Prowler or Trivy for container images?

Trivy directly, in CI, is the simpler choice. Use Prowler's image provider when you want image findings in the same reports and web app as your cloud account findings.

Do I need both Prowler and Trivy?

If you build containers or use IaC and also run cloud accounts, yes. Trivy covers what you build, Prowler covers the accounts you deploy to.

Prowler is a trademark of its owners. Kevra is not affiliated with, endorsed by or sponsored by Prowler. Kevra Security runs the open-source Prowler project (Apache-2.0) as a managed service.