Grype

Position

Grype is Anchore's vulnerability scanner and the counterpart to Syft, its SBOM generator. Where Trivy bundles many concerns into one tool, Grype does vulnerability matching and leaves the rest alone.

That focus suits a specific workflow: generate an SBOM once at build time with Syft, store it, and rescan that SBOM as the vulnerability database updates. You learn about a newly-disclosed CVE affecting a six-month-old image without rebuilding or re-pulling it. For organisations with artifact retention requirements, this is the more defensible pattern.

Formats and suppression

Grype accepts CycloneDX, SPDX and Syft's own JSON, so it slots into existing SBOM pipelines rather than requiring its own. It scans container images, filesystems and archives.

OpenVEX support is the feature worth calling out. VEX documents record that a vulnerability has been assessed and does not apply — the dependency is present but unreachable, say. Instead of an ignore-list that hides findings with no audit trail, suppression becomes a signed, reviewable statement about why something was dismissed. For teams that have to explain their triage to an auditor, that difference matters.

Speed

A 2026 comparison measured Grype roughly 30-40% faster than Trivy on pure matching with a warm cache. The same comparison found that on cold scans of a 500 MB image both land around 8-9 seconds, so the gap closes once database download dominates. Speed is unlikely to be the deciding factor between them.

What it will not do

No IaC scanning, no secret detection, no licence analysis. If you want those, you are running Trivy as well, or Checkov and Gitleaks alongside Grype. Choosing Grype means accepting a toolchain of focused pieces rather than one binary covering everything — a reasonable preference, but a deliberate one.

The SBOM-first workflow in practice

The pattern Anchore recommends is worth spelling out because it changes what scanning means operationally. At build time, Syft generates an SBOM and that SBOM is stored as a build artifact. Scanning then runs against the stored SBOM, not the image.

The consequence is that vulnerability status becomes a query over inventory rather than a property of a scan run. When a CVE lands on a Tuesday, you can answer "which of our 400 deployed services contain this package" by rescanning stored SBOMs in minutes, without pulling 400 images. Teams that scan images directly have to rebuild or re-pull to answer the same question.

Where it sits alongside Trivy

These tools are frequently compared as alternatives when they are reasonable companions. Trivy covers breadth — IaC, secrets, licences — and Grype covers vulnerability matching with a cleaner SBOM and VEX story. Running Trivy for its IaC and secret checks and Grype against stored SBOMs for ongoing vulnerability tracking is a defensible arrangement, and neither licence costs anything.