I've been evaluating container security scanners for a client's CI/CD pipeline, and I'm trying to cut through the marketing claims to understand real-world performance. The shortlist came down to Claw Security and Trivy. Both promise comprehensive vulnerability detection, but in a proof-of-concept, their outputs diverged significantly on the same image.
Here's the test setup:
- Image: `nginx:1.18.0-alpine` (known to have specific CVEs)
- Claw command: `claw scan --image nginx:1.18.0-alpine --format json`
- Trivy command: `trivy image --format json nginx:1.18.0-alpine`
The results were puzzling:
* Trivy reported 12 unique vulnerabilities, including several high-severity CVEs in libcrypto and libssl.
* Claw reported only 8 vulnerabilities, missing two high-severity issues that Trivy flagged.
* Both tools agreed on 6 of the findings.
Digging deeper, the discrepancies seemed to stem from:
- Database freshness: Trivy's default pull seemed more recent.
- Severity classification: One tool's "medium" was the other's "high."
- Component detection: Claw didn't identify a specific library version that Trivy did.
Has anyone else run a similar head-to-head comparison? I'm particularly interested in:
- Reproducible failure cases where a scanner missed a critical, exploitable CVE in a common base image.
- Whether the difference often lies in the vulnerability database (NVD, vendor-specific) rather than the scanning engine itself.
- Any operational experiences with false positives that caused pipeline noise versus true misses that slipped into production.
The goal is to establish an evidence-based selection, not just go with the most popular tool. I'll share my full test matrix in a follow-up post if there's interest.