Cracken + Trivy
Cracken runs Trivy inside a container image or filesystem to find the vulnerable packages and embedded secrets actually shipped. It works the ones it can reach from its foothold.
Connecting Trivy
- Connect with
No credentials — runs on your own Tentacle
- Cadence
Runs on demand — installed per Tentacle, then invoked during an operation
- Requires
Linux or macOS Tentacle
What Cracken gets from Trivy
Vulnerable packages with package name, installed vs fixed version, CVE id and severity
Exposed secrets found in the image or filesystem
IaC/config misconfigurations
An SBOM of the scanned target
What Trivy does not do
Reports what is present in the image or filesystem — it does not prove a listed vulnerability is reachable or exploitable, which Cracken works separately.
How Cracken uses Trivy
- 01
Install Trivy on a Tentacle
- 02
Point Cracken at an image, filesystem, or repository
- 03
Work the reachable entries
- 04
Confirm the Tentacle is ready
Frequently asked questions
What can Cracken scan with Trivy?
Trivy scans container images, filesystems, and repositories for vulnerabilities in OS packages and dependencies, infrastructure-as-code misconfigurations, and leaked secrets, whichever an operation reaches.
Does a Trivy CVE become a Cracken finding?
Not on its own: Cracken treats each installed version as a lead, attempts to reach and use it, and records only what it demonstrated.
“…we've been continuously validating … the efficacy of Cracken with our own pen tests, like external pen test findings. Just being sure that we could recreate those with Cracken. It's been going good so far…”
Attack with real Trivy context.
See how Cracken runs Trivy on a Tentacle you host, and proves what it finds end to end.