The 1Password study that made the rounds last month landed with a specific number: only 26 percent of AI-generated security patches fully fix the flaws they’re aimed at. The rest either partially patch, patch the wrong function, or introduce a new dependency with its own CVE. That’s a real problem in a world where AI code assistants land patches faster than humans can review them, and where the SBOM (Software Bill of Materials) is often the last line of defense between shipped code and shipped vulnerabilities.
We tested seven SBOM and dependency scanners on desktop across a mixed portfolio: Node, Python, Go, Rust, and container-native services. Every tool on this list generates SBOMs, ingests them, or scans dependency graphs for known CVEs. All seven are free and open-source.
What to look for in a dependency scanner
The security-scanner market is genuinely crowded, and it’s easy to install five tools that do the same thing. When picking, weigh:
- SBOM formats supported. SPDX and CycloneDX are the two that matter. If a tool only outputs its own JSON, walk away.
- Language and ecosystem coverage. Some scanners cover the JVM well and Node barely. Match to your stack.
- CVE database freshness. OSV, NVD, and GitHub Advisory Database are the three sources worth trusting. Aggregators exist but add latency.
- Container awareness. If you ship containers, the scanner needs to walk image layers, not just the source repo.
- CI integration. GitHub Actions, GitLab CI, and Jenkins support are table stakes.
- False-positive rate. A scanner that flags 400 CVEs on a fresh Next.js install is a scanner nobody reads.
- Licensing report. SBOMs increasingly need license audits alongside CVE lists.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price | Formats |
|---|---|---|---|---|---|
| Syft | SBOM generation | Windows, macOS, Linux | Free, open-source | Free | SPDX, CycloneDX, native |
| Grype | SBOM scanning | Windows, macOS, Linux | Free, open-source | Free | Reads Syft, SPDX |
| Trivy | All-in-one container scan | Windows, macOS, Linux | Free, open-source | Free | SPDX, CycloneDX |
| Dependency-Track | SBOM management platform | Docker, self-hosted | Free, open-source | Free | CycloneDX-first |
| OWASP Dependency-Check | Long-standing SCA classic | Windows, macOS, Linux | Free, open-source | Free | CVSS report |
| OSV-Scanner | Google’s OSV.dev frontend | Windows, macOS, Linux | Free, open-source | Free | Native OSV, SPDX |
| Renovate | Automated dependency updates | Docker, self-hosted, cloud | Free, open-source | Free (Mend hosted paid) | Update PRs |
The apps
1. Syft — Best SBOM generator
Syft from Anchore is the SBOM tool most other tools now assume you’re using. Point it at a directory, container image, or archive, and it emits a full SBOM in SPDX or CycloneDX format in seconds. Language coverage is broad (Go, Node, Python, Ruby, Rust, Java, .NET, and more), and container-image support walks every layer without needing the container to run.
Where it falls short: Doesn’t scan for CVEs itself. Pair with Grype (from the same team) or feed the SBOM into Dependency-Track.
Pricing:
- Free: Fully free, Apache 2.0
Platforms: Windows, macOS, Linux, and as a container
Download: Syft on GitHub · Anchore product page
Bottom line: The default SBOM generator. Install it first.
2. Grype — Best SBOM scanner
Grype is the CVE scanner that pairs naturally with Syft. Feed it an SBOM (or point it at a source directory) and it returns a filtered CVE list from the Anchore vulnerability feed, itself sourced from NVD, GitHub Advisory Database, and Alpine’s own security data.
Where it falls short: Not the most opinionated on false-positive management. Expect to build a suppression file for legacy dependencies you can’t upgrade.
Pricing:
- Free: Fully free, Apache 2.0
Platforms: Windows, macOS, Linux, and as a container
Download: Grype on GitHub
Bottom line: The obvious pairing for Syft, and the fastest scanner on this list for a plain source-tree pass.
3. Trivy — Best all-in-one container scanner
Trivy from Aqua Security is the all-in-one everyone reaches for when the target is container-native. It scans containers, filesystems, git repos, Kubernetes manifests, IaC (Terraform, CloudFormation), and secrets in one binary. SBOM generation is baked in for both SPDX and CycloneDX.
Where it falls short: The breadth means it’s slower on any single target than a purpose-built tool. Configuration file grows as you use more scan types.
Pricing:
- Free: Fully free, Apache 2.0
Platforms: Windows, macOS, Linux, and as a container
Download: Trivy on GitHub
Bottom line: If you can only install one scanner, install this.
4. Dependency-Track — Best SBOM management platform
Dependency-Track turns SBOM scanning from a per-run activity into a fleet-wide dashboard. Feed it CycloneDX SBOMs from your CI pipelines, and every project gets a live vulnerability, license, and policy dashboard. The alert pipeline routes new CVEs to Slack, email, or webhooks per project.
Where it falls short: Requires a self-hosted Java or container deployment. Not a “grab a binary and run” tool.
Pricing:
- Free: Fully free, Apache 2.0
Platforms: Docker, JAR (self-hosted)
Download: Dependency-Track on GitHub
Bottom line: For teams tracking more than a handful of services.
5. OWASP Dependency-Check — Best long-standing SCA classic
OWASP Dependency-Check has been around long enough that most enterprise pipelines already know it. Java-first, but modern versions cover Node, Python, Ruby, and .NET. Output is a CVSS-scored report in HTML, JSON, or XML.
Where it falls short: Slower and more resource-heavy than modern alternatives. First run downloads the entire NVD feed, which takes minutes.
Pricing:
- Free: Fully free, Apache 2.0
Platforms: Windows, macOS, Linux
Download: OWASP Dependency-Check on GitHub
Bottom line: The reliable classic. Install it if your team is already familiar; otherwise start with Trivy or Grype.
6. OSV-Scanner — Best OSV.dev frontend
OSV-Scanner is Google’s official frontend for OSV.dev, the open-source vulnerability database. It scans lockfiles across Node, Python, Go, Rust, Ruby, and many others, cross-references against OSV.dev, and produces a per-package vulnerability list. OSV.dev’s data quality is high because it aggregates from a wide set of ecosystem-specific databases.
Where it falls short: Doesn’t do container-image scanning. Focus is lockfile-first.
Pricing:
- Free: Fully free, Apache 2.0
Platforms: Windows, macOS, Linux
Download: OSV-Scanner on GitHub
Bottom line: The best pick for teams that live in lockfiles and want minimal ceremony.
7. Renovate — Best automated dependency updates
Renovate is not a scanner in the classic sense. It’s a dependency-update bot that opens PRs when new versions of your dependencies land, including security-patch releases. Combined with any of the scanners above, it closes the loop between “CVE found” and “PR to fix” without human orchestration.
Where it falls short: Not a CVE scanner in isolation. Combine with Grype, Trivy, or OSV-Scanner for the scan-and-verify half of the workflow.
Pricing:
- Free: Self-hosted community edition, fully open-source (AGPL-3.0)
- Paid: Mend hosts a managed version for organizations that don’t want to self-host
Platforms: Docker, self-hosted, or Mend cloud
Download: Renovate on GitHub
Bottom line: The tool that turns scanner findings into merged fixes.
How to pick the right one
If you need one tool and you ship containers: Trivy. It covers containers, filesystems, IaC, and secrets in a single binary.
If you’re building an SBOM-first workflow: Syft plus Grype plus Dependency-Track. Syft generates, Grype scans, Dependency-Track manages across services.
If your team is already on OWASP Dependency-Check: keep it. Modern versions are respectable, and switching mid-pipeline creates gaps.
If your language is Python, Node, Go, or Rust and you want the tightest signal: OSV-Scanner. The OSV.dev data is high-quality.
If you want automated fixes for the CVEs the scanners find: layer Renovate on top. It handles the PR-opening half of the workflow.
If your AI code assistant is opening patch PRs (as the 1Password study noted): run any scanner above as a required check before merge. AI-generated patches need machine verification precisely because they miss the flaws 74 percent of the time.
FAQ
What is an SBOM?
An SBOM (Software Bill of Materials) is a structured list of every dependency in a piece of software, with versions, hashes, and licenses. SPDX and CycloneDX are the two dominant formats. Regulators in the US and EU are increasingly requiring SBOMs for software shipped into government supply chains.
Are SBOM tools free?
Every tool in this list is free and open-source. Paid offerings exist (Anchore Enterprise, Aqua Enterprise, Mend hosted Renovate) but the open-source versions cover most teams’ needs.
Which tool has the fewest false positives?
OSV-Scanner and Grype have the tightest false-positive profiles in our testing, because both pull from curated, ecosystem-specific data. Legacy tools that rely heavily on NVD strings tend to produce more noise.
Do these tools work in air-gapped environments?
Yes, with configuration. Trivy, Grype, and OWASP Dependency-Check all support offline database updates. Dependency-Track can pull from a mirrored OSS Index or Anchore feed.
Can these tools scan container images?
Trivy, Grype, and Syft all scan container images and walk every layer. Dependency-Check and OSV-Scanner are lockfile-first and don’t handle containers as well.
How often should I run an SBOM scan?
For actively developed services, run on every PR and every release. For deployed services, re-scan the shipped SBOM against fresh CVE feeds at least daily. Dependency-Track and Trivy support both continuous and scheduled scans.
