Secure your Trivy surface
Container, IaC, and dependency scan results correlated to what is actually deployed. We don’t connect to Trivy to collect evidence for its own sake — we connect to secure it, and the compliance artefacts follow from that work.
Book a Demo[01] What This Surface Exposes
Where Trivy goes wrong
Trivy goes wrong when its findings sit apart from reality: results from CI say little about the image actually running in production.
- Scans run in CI but not against images currently running in production
- IaC misconfiguration findings separated from the cloud drift they cause
- Severity thresholds set so high that real issues pass
- Scan results not retained, so trend and regression are invisible
- Secret detection results not acted on beyond the build failure
[02] What We Secure
What we watch, catch and fix on Trivy
On Trivy we map findings to running workloads and correlate IaC misconfigurations with actual cloud state.
- Findings mapped to running workloads, since the image in the registry is not always the image in production
- IaC findings correlated with actual cloud state to distinguish theoretical from live exposure
- Threshold configuration reviewed against your risk appetite rather than left at defaults
- Result history retained for trend analysis
- Detected secrets escalated to rotation, not just to a failed build
[03] Where It Lands
Where Trivy lands in your registers
Repositories and pipelines become asset register entries with their own criticality, because a build system that can deploy to production is a production system. Access reviews cover repository and pipeline permissions alongside your other entitlements, and the risk register carries supply chain exposure — the dependencies you pull, the actions you run, and who can push without review.
[04] How We Engage
On Trivy specifically
On Trivy, we tune thresholds, wire findings into remediation tracking, and drive fixes. Secrets found in images we treat as incidents and coordinate rotation.
Platform licence
Everything you need to find and fix it yourself, with no ceiling on the depth of the answer.
- Every connected tool monitored for misconfiguration and drift, with findings mapped to the assets and risks they affect
- Remediation guidance that tells you what is wrong and exactly how to fix it — however deep or awkward the issue is. We are engineers running a security company, so the answer is the real one, not a link to vendor documentation
- Assets, access reviews, and risk register populated from the tools themselves rather than from spreadsheets
- Unlimited integrations and unlimited users, with anything missing built within two weeks
Managed service
Every tool you connect through Konfirmity comes under our care, with our team doing the work.
- Continuous misconfiguration and drift monitoring across every connected tool, watched by our analysts rather than by a dashboard waiting for you
- Incident response led by us, with containment coordinated with your team
- Remediation performed directly wherever you have granted us the authority to act — and where we cannot act, we project-manage the fix to completion rather than handing you a ticket
- Decision support on the tools themselves: where something is failing you on capability or costing more than it returns, we will tell you, and help you replace it
[05] Trivy FAQs
How does Konfirmity use Trivy results?
We ingest scan output from your pipeline and reconcile it against deployed workloads, so a finding is tied to something running rather than to a build artefact. Where Trivy reports an IaC misconfiguration, we check whether the corresponding cloud resource is actually misconfigured.
What happens when Trivy finds a secret?
It escalates beyond a failed build. A detected secret means a live credential is in an artefact, so we identify what it protects and drive rotation. Failing the pipeline stops the artefact shipping but does nothing about the credential already exposed.
GitHub
GitLab
Bitbucket
Jenkins
CircleCI