Migrate from Trivy to cnspec

This guide is for DevOps engineers, platform engineers, and security practitioners who currently use Trivy and want to migrate to cnspec. It maps common Trivy workflows to their cnspec equivalents and highlights where cnspec goes beyond vulnerability scanning.

Feature comparison at a glance

Installation and setup

Install cnspec

Trivy is typically installed through a package manager or Docker image. cnspec offers similar options:

# macOS
brew install mondoohq/mondoo/cnspec

# Linux (Debian/Ubuntu)
curl -sSL https://install.mondoo.com/sh | bash

# Docker
docker run -it mondoo/cnspec scan <target>

For detailed installation options, see Installation overview.

Authenticate with Mondoo Platform (optional)

While Trivy works as a standalone scanner, cnspec can optionally connect to Mondoo Platform for centralized reporting, policy management, and continuous monitoring:

cnspec login --token <your-token> --config-path /etc/opt/mondoo/mondoo.yml

CLI structure comparison

Both tools follow a similar CLI pattern:

A key difference: Trivy uses trivy config as a catch-all for misconfiguration scanning across IaC tools, while cnspec uses explicit subcommands for each target type.

Container image scanning

Basic image scan

# Trivy
trivy image alpine:3.20

# cnspec
cnspec scan container alpine:3.20

Registry scanning

cnspec supports the same container registries as Trivy, including ECR, ACR, GCR, Docker Hub, and Harbor:

# Trivy
trivy image 123456789.dkr.ecr.us-east-1.amazonaws.com/my-app:latest

# cnspec
cnspec scan container registry 123456789.dkr.ecr.us-east-1.amazonaws.com/my-app:latest

cnspec uses the container runtime's configured credentials, so if you can docker pull an image, cnspec can scan it.

Dockerfile scanning

# Trivy
trivy config Dockerfile

# cnspec
cnspec scan docker file Dockerfile

Running container scanning

Unlike Trivy, cnspec can also scan running containers:

cnspec scan docker CONTAINER_ID

Filesystem and repository scanning

Filesystem scanning

# Trivy
trivy fs .

# cnspec
cnspec scan fs .

Repository scanning

Trivy has a dedicated trivy repo command for scanning remote Git repositories. With cnspec, clone the repository first and scan it as a filesystem:

# Trivy
trivy repo https://github.com/example/repo

# cnspec
git clone https://github.com/example/repo
cnspec scan fs repo

Infrastructure as Code scanning

Trivy uses trivy config for all IaC scanning. cnspec provides dedicated subcommands for each IaC tool, giving you more precise control.

Terraform

# Trivy
trivy config --tf ./terraform/

# cnspec — scan HCL files
cnspec scan terraform ./terraform/

# cnspec — scan a Terraform plan
terraform plan -out=plan.out
terraform show -json plan.out > plan.json
cnspec scan terraform plan plan.json

# cnspec — scan Terraform state
cnspec scan terraform state

cnspec's separate commands for HCL, plan, and state scanning let you check security at every stage of the Terraform workflow.

CloudFormation

# Trivy
trivy config ./cloudformation/

# cnspec
cnspec scan cloudformation template.json

Kubernetes manifests

# Trivy
trivy config -n k8s deployment.yaml

# cnspec
cnspec scan k8s deployment.yaml

Kubernetes cluster scanning

Basic cluster scan

# Trivy
trivy k8s --report=summary

# cnspec
cnspec scan k8s

Both tools use your current kubeconfig context.

Targeted resource scanning

# Trivy
trivy k8s --include-namespaces default --report=summary

# cnspec — discover specific resource types
cnspec scan k8s --discover pods,deployments

Continuous cluster scanning

Trivy can run as an operator inside a cluster, but its primary mode is on-demand scanning. cnspec offers the Mondoo Kubernetes Operator for continuous security monitoring of your clusters, with results reported to Mondoo Platform.

SBOM generation

# Trivy
trivy sbom alpine:3.20

# cnspec
cnspec sbom alpine:3.20

Both tools generate software bills of materials. cnspec supports CycloneDX and SPDX output formats.

CI/CD integration

GitHub Actions

# Trivy
- name: Run Trivy
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'my-app:${{ github.sha }}'

# cnspec
- name: Run cnspec
  uses: mondoohq/actions/scan@main
  with:
    service-account-credentials: ${{ secrets.MONDOO_SERVICE_ACCOUNT }}
    scan-type: docker-image
    target: 'my-app:${{ github.sha }}'

GitLab CI

# Trivy
trivy_scan:
  image: aquasec/trivy:latest
  script:
    - trivy image my-app:latest

# cnspec
cnspec_scan:
  image: mondoo/cnspec:latest
  script:
    - cnspec scan container my-app:latest --incognito

Output formats for CI

# Trivy
trivy image --format json -o results.json my-app:latest

# cnspec
cnspec scan container my-app:latest -o json > results.json

Policies and custom rules

Policy approach comparison

Trivy uses Rego (Open Policy Agent) for custom policies. cnspec uses MQL (Mondoo Query Language), which is purpose-built for infrastructure security queries.

Example: Ensure containers don't run as root

Trivy (Rego):

package custom

deny[msg] {
    input.kind == "Deployment"
    container := input.spec.template.spec.containers[_]
    not container.securityContext.runAsNonRoot
    msg := sprintf("Container %s must set runAsNonRoot", [container.name])
}

cnspec (MQL):

k8s.deployments.all(
  containers.all(
    securityContext['runAsNonRoot'] == true
  )
)

Policy management

Trivy bundles its checks and supports custom Rego policies via the --policy flag. cnspec provides:

• Policy registry: A library of ready-to-use policies in the Mondoo Policy Hub
• Custom policies: Write your own policies using MQL and apply them with --policy-bundle:

cnspec scan k8s --policy-bundle my-policy.mql.yaml

• Centralized management: Manage and assign policies across your infrastructure through Mondoo Platform

To learn more, see Writing custom policies.

Output formats and reporting

Format comparison

# Trivy — default table output
trivy image alpine:3.20

# cnspec — default compact output
cnspec scan container alpine:3.20

# Trivy — JSON output
trivy image --format json alpine:3.20

# cnspec — JSON output
cnspec scan container alpine:3.20 -o json

# cnspec — full detail output
cnspec scan container alpine:3.20 -o full

# cnspec — JUnit for CI
cnspec scan container alpine:3.20 -o junit

When connected to Mondoo Platform, scan results are also available in the web console with dashboards, trends, and fleet-wide views.

Command reference cheat sheet

What's next: Beyond vulnerability scanning

If you're migrating from Trivy, you're already familiar with vulnerability and misconfiguration scanning. cnspec extends your security coverage to areas Trivy doesn't reach:

• Cloud security posture: Scan AWS, Azure, GCP, and OCI accounts for misconfigurations and compliance violations.
• SaaS security: Assess the security configuration of GitHub, GitLab, Google Workspace, Slack, and Microsoft 365.
• Operating system security: Scan Linux and Windows hosts over SSH or WinRM.
• Network devices: Assess network device security configurations.
• Compliance frameworks: Map your security posture to CIS Benchmarks, SOC 2, PCI DSS, HIPAA, and other frameworks.
• Continuous monitoring: Use Mondoo Platform to continuously monitor your entire infrastructure from a single dashboard.

For the full list of supported scan targets, see Supported scan targets.