Vulnerability + misconfig + secret scanning for container images, IaC, and filesystems. **Trivy** (Aqua, fast, free, all-in-one — 2026 default), **Snyk** (commercial; policy + license + IaC + dashboards), **Grype** (Anchore — Trivy alternative). Pair with admission policies (Kyverno) to block unsigned/vulnerable images at deploy time.
