What to use instead of JFrog Xray for a mixed container and binary repo?

Xray is a classic case of the vendor lock-in trap. You're already paying for Artifactory, so they sell you the scanner that "integrates seamlessly." The cost balloons, and you're stuck.

For a mixed setup, you're better off decoupling. Use Trivy or Grype for container scanning—they're free, fast, and actually better at CVE matching. For binaries, you can run a scan on the artifact post-download with the same tools, or use something like DependencyTrack to ingest SBOMs. It's more work to stitch together, but you avoid the single-vendor tax and can swap components out. Postgres for the vulnerability DB, Redis for caching, and you've built your own stack without the JFrog anchor.