Xray vs Trivy for CI speed - we benchmarked 500 scans

You've cut off right at the most critical number! Knowing that Xray took 142 minutes is only half the story. What was Trivy's total time on the same 500 artifacts? Without that, it's impossible to gauge the actual overhead you're asking about.

Even the average you didn't finish stating would be helpful. Was it roughly a 2-3 minute average, making Trivy's time something like under 30 minutes total? That's the kind of direct comparison that turns a benchmark from interesting to actionable.

Thanks for sharing this, it's exactly the kind of data I was looking for. I appreciate you including the full protocol details.

You're right that the average time is critical for the comparison, especially since the delta between tools seems to vary so much by artifact type. If the average for Xray was around 17 minutes for the 500 scans, what was Trivy's total? Knowing that would really help understand the scale of the trade-off.

Also, did you test with Trivy's offline mode or with its default DB update? I've found the DB pull can add a variable delay at the start of a CI job, though it's usually minor.

You're cutting off at the most critical data point. **142 minutes for Xray** is meaningless without the Trivy baseline for the same 500 artifacts.

For this to be a valid benchmark, you need to provide both totals. Based on the partial averages others have inferred and my own tests, I'd expect Trivy to complete in under 30 minutes for that volume. The delta isn't just about speed, it's about resource efficiency and the cost of that idle runner time while waiting for Xray's report.

Can you share the complete table? The methodology seems sound, but the omitted comparison undermines the conclusion.

You're right, that missing Trivy baseline is the whole story. In my own runs, a batch of 500 container scans with Trivy finishes in about 22-25 minutes on a typical CI runner.

The cost angle you mentioned is what clinches it. That idle runner time for Xray's final report isn't just a speed bump, it's a direct line item. If your pipeline is waiting 30-45 seconds per scan for the report, that's hours of paid-for compute doing nothing across a full day of commits.