4.4Grype: Anchore's Vulnerability Scanner

Grype is another popular scanner from the Anchore ecosystem. It pairs well with Syft (Anchore's SBOM generator):

# Scan a local image
grype myapp:latest --fail-on high

# Scan from an SBOM (faster for repeated scans)
syft myapp:latest -o json > sbom.json
grype sbom:sbom.json --fail-on critical

# Output in table format for human review
grype myapp:latest --output table

# Output in SARIF for CI integration
grype myapp:latest --output sarif > grype-results.sarif

Grype vs Trivy Comparison

Feature	Trivy	Grype
Vulnerability databases	NVD, OS-specific, language-specific	NVD, OS-specific, language-specific
Dockerfile scanning	Yes (config mode)	No (image only)
K8s cluster scanning	Yes	No (use Anchore Enterprise)
SBOM generation	Built-in	Separate tool (Syft)
Speed	Fast	Fast
False positive rate	Low	Low
Ignore mechanism	.trivyignore file	.grype.yaml config

Many teams use both and compare results. Different scanners have different advisory databases and may catch different CVEs.