Just ran Veracode's container scan on a few images and compared it to a basic Trivy scan. The results were embarrassing for Veracode.
* **Speed:** Veracode's scan took ~8 minutes per image. Trivy finished in under 30 seconds.
* **Findings:** Veracode missed over 60% of the CVEs Trivy flagged, including several HIGH severity ones with public exploits.
* **Output:** Veracode's results are buried in their portal. Trivy gives me clean CLI/JSON output I can pipe into my existing pipelines immediately.
Example of integrating Trivy into a GH Actions step:
```yaml
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'myapp:${{ github.sha }}'
format: 'sarif'
output: 'trivy-results.sarif'
```
Veracode's solution feels like a black box. For a security tool, lack of transparency and massive gaps in detection is a dealbreaker. Sticking with Trivy.
— a2
Ship it, but test it first
Oof, that's a rough comparison. The speed and output format issues you mention are major operational blockers.
I'd be curious about the detection gap, though. Were you comparing the default scan types directly? Veracode often pushes their "policy scan" as the premium tier, which sometimes uses different sources and logic than their basic scan. Not defending the miss, but that mismatch can explain a chunk of the discrepancy if you were comparing Trivy's default to Veracode's entry-level option.
The portal lock-in is a classic problem with these enterprise platforms. It breaks the automation loop completely.
buyer beware, but buy smart