The artifact scanner and the Terraform reviewer
Trivy consolidates more of open-source security into one binary than any tool we know: containers, images, SBOMs, Kubernetes, and IaC. audytx does one thing instead. It goes deep on AWS Terraform, building cross-resource relationship graphs so it can catch what a checklist structurally can't: IAM privilege-escalation chains, trust-graph risk, and the false positives that context proves benign. You don't have to pick between them; they cover different ground.
audytx vs Trivy at a glance
Measured rows from the pinned public benchmark — full tables, methodology, and reproduction steps on the comparison page.
| Dimension | audytx | Trivy |
|---|---|---|
| IAM privilege-escalation recall (31 paths) | 100% | 0% (7 HIGH findings, none correct) |
| False positives, 21 clean modules | 33 | 175 |
| False-positive handling | context-proven suppression, rationale shown | inline ignore comments |
| Cross-resource reasoning | relationship graphs precede every verdict | per-resource misconfiguration checks |
| Scope | AWS Terraform, reasoned about deeply | containers, images, SBOMs, K8s, VMs, multi-cloud IaC |
| Agent surface | hosted MCP server — scan, autofix loop, context graph, nothing to install | trivy-mcp plugin for a local CLI |
| Delivery | GitHub App + hosted MCP + offline CLI | CLI / CI step / K8s operator |
Trivy scope per its repository (actively maintained by Aqua Security); benchmark pinned to Trivy 0.71.0 — versions and dates in the methodology. Trivy also carries the former tfsec engine — see the tfsec migration page.
Why the IAM gap won't close with more rules
You can't detect a privilege-escalation path by adding a rule for it.
iam:CreatePolicyVersion on a wildcard resource is only an
escalation if the policy is attached to a principal the caller can reach; a
PassRole chain only matters if something can invoke the target service. Answering
those questions means holding the whole trust graph in memory and walking it, which is
what audytx does before any rule fires. A per-resource checker, however well maintained,
is answering a different question ("does this block match a bad pattern?") — and on the
iam-vulnerable corpus, that difference is 31 paths detected versus none.
The same graph is what lets audytx suppress with confidence: a finding is only
filtered out when a relationship proves it benign, and the proof is printed.
How the IAM engine works →
Run them where each is strongest
audytx — on the Terraform
- Reviews every PR as a GitHub App: one comment, inline annotations, SARIF to Code Scanning
- Full IAM attack-path coverage with cross-resource trust reasoning
- Suppressions are automatic, deterministic, and always show their rationale
- Hosted MCP server: your coding agent gets scan + autofix + context graph before the PR exists
Trivy — on the artifacts
- Container images, filesystems, SBOMs, and VM images in one binary
- CVE scanning against OS packages and language dependencies
- Kubernetes manifests and Helm charts alongside the rest
- A natural fit for airgapped and self-contained CI environments
The combined pipeline is simple: Trivy gates the image build; audytx gates the infrastructure PR. And if you're also weighing Checkov's breadth-first approach, the neutral Checkov vs Trivy field guide covers all three side by side.
Frequently asked questions
Is audytx a Trivy alternative?
For AWS Terraform, yes — audytx detects all 31 documented IAM privilege-escalation paths where Trivy's checks detect none, with 5× fewer clean-module false positives (33 vs 175). For containers, images, and SBOMs, Trivy is the right tool and audytx doesn't compete there; run them together.
Does Trivy detect IAM privilege escalation?
In the public benchmark on BishopFox's iam-vulnerable corpus, no — Trivy fired 7 HIGH findings across the 31 escalation paths, none of them correct privilege-escalation detections (0% recall). Its Terraform coverage centers on per-resource misconfigurations; walking IAM trust graphs is a different architecture.
Should I run audytx and Trivy together?
Yes, and many teams should: Trivy gates container images and dependencies, audytx reviews the Terraform PRs where IAM and cross-resource risk live. The tools don't overlap in what they're best at, and audytx's one-comment-per-PR format keeps the review surface clean.
Add the Terraform reviewer next to your artifact scanner
Install the GitHub App and audytx reviews your next pull request — free on every repo during the beta.