Aqua Trivy

Overview

QCecuring extends Aqua Trivy’s container and infrastructure scanning with deep cryptographic asset discovery. While Trivy identifies vulnerabilities in container images and IaC, QCecuring discovers embedded certificates, keys, and crypto configurations within those same assets.

Key capabilities

• Scan container images for embedded certificates, keys, and crypto configurations alongside Trivy’s vulnerability scanning.
• Discover cryptographic assets in Kubernetes manifests and Helm charts.
• Generate CBOM data that complements Trivy’s SBOM output.
• Identify deprecated crypto algorithms in container base images.

Typical use cases

• Container security teams needing cryptographic visibility alongside vulnerability scanning.
• Organizations running Trivy in CI/CD who want to add crypto risk assessment.
• Platform teams building comprehensive container security with both Trivy and QCecuring.

High-level integration flow

1. Trivy scans container images and infrastructure for vulnerabilities.
2. QCecuring scans the same assets for cryptographic usage and embedded certificates.
3. Both tools generate complementary BOM data — SBOM from Trivy, CBOM from QCecuring.
4. Combined output provides full software and cryptographic risk visibility.