# Difference Between Trivy's Vulnerability Scanner and SBOM Scanner: Architecture and Usage

> Discover the key differences between Trivy's vulnerability scanner and SBOM scanner. Learn their architectures and usage to enhance your security scanning.

- Repository: [Aqua Security/trivy](https://github.com/aquasecurity/trivy)
- Tags: deep-dive
- Published: 2026-03-23

---

**Trivy's vulnerability scanner analyzes live artifacts to detect CVEs and misconfigurations, while the SBOM scanner is a virtual component that consumes existing SBOM files to generate reports, optionally enriching them with vulnerability data.**

The aquasecurity/trivy repository provides two distinct scanning modes that serve different purposes in the software supply chain. While both operate within the same scanning framework, they differ fundamentally in input handling, execution paths, and activation triggers.

## Core Architectural Distinctions

At the type system level, Trivy defines these scanners in [`pkg/types/scan.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/types/scan.go) as distinct constants:

```go
// SBOMScanner is the virtual scanner of SBOM, which cannot be enabled by the user
SBOMScanner Scanner = "sbom"
// VulnerabilityScanner is the scanner of vulnerabilities
VulnerabilityScanner Scanner = "vuln"

```

The **vulnerability scanner** (`vuln`) performs live analysis on container images, filesystems, or Git repositories to detect security issues. The **SBOM scanner** (`sbom`) functions as a virtual decoder that ingests existing CycloneDX, SPDX, or Trivy-generated SBOM files and converts them into Trivy’s internal report format.

### How the Vulnerability Scanner Works

When enabled via `--scanners vuln` or through default scanner sets, the vulnerability scanner executes OS package and language-specific detectors. In [`pkg/scan/local/service.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/scan/local/service.go), the `scanVulnerabilities` function triggers `ospkg.Scanner` and `langpkg.Scanner` to enumerate installed packages and match them against vulnerability databases.

This scanner produces a `Result` containing `Vulnerabilities`, `Misconfigurations`, `Secrets`, and license information directly from the scanned artifact. It requires access to the live filesystem or image layers to perform package discovery.

### How the SBOM Scanner Works

The SBOM scanner operates differently: it cannot be explicitly enabled by users through the `--scanners` flag. Instead, Trivy automatically activates it via the `enableSBOM()` method in [`pkg/flag/options.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/options.go) when the scanning pipeline requires package metadata—such as when using `trivy sbom` commands, generating SBOM output formats, or using `--list-all-pkgs`.

In [`pkg/scan/local/service.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/scan/local/service.go), the `ScanTarget` function checks scanner activation using:

```go
if !options.Scanners.AnyEnabled(types.SBOMScanner, types.VulnerabilityScanner) {
    return nil, false, nil
}

```

When only the SBOM scanner is enabled, the code path skips live package detection entirely and proceeds directly to SBOM decoding via [`pkg/sbom/io/decode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/decode.go). The encoder logic in [`pkg/sbom/io/encode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/encode.go) comments explicitly defines two scenarios: "SBOM scanning: When scanning an existing SBOM file to refresh vulnerabilities" and "Library usage: When using Trivy as a library with a custom BOM in the report."

## Implementation Path and Control Flow

The execution flow in [`pkg/scan/local/service.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/scan/local/service.go) illustrates the tight integration between these scanners. When both are enabled, the SBOM scanner decodes the existing SBOM into a `Result` with `Class: types.ClassSBOM`, populating the `Packages` field. Subsequently, the vulnerability scanner enriches these packages with current CVE data.

If only the SBOM scanner is active, the process stops after decoding, producing a pure SBOM report without vulnerability lookup. This distinction matters for CI pipelines that need to generate component lists without triggering database queries or for re-scanning stale SBOMs against updated vulnerability feeds.

## Practical Usage Examples

### Generate a Pure SBOM Without Vulnerability Data

To create a CycloneDX SBOM without performing any vulnerability analysis:

```bash
trivy sbom nginx:latest --format cyclonedx

```

This command automatically enables the SBOM scanner and suppresses the vulnerability scanner, producing only the component inventory.

### Re-scan an Existing SBOM for Current Vulnerabilities

To refresh vulnerability data against an existing SBOM file:

```bash
trivy sbom my-app.cdx.json --scanners vuln

```

Here, the SBOM scanner decodes the CycloneDX file, and the explicit `--scanners vuln` flag triggers vulnerability enrichment on the decoded package list.

### Programmatic Library Usage

When using Trivy as a Go library, control the scanner behavior through `types.ScanOptions`:

```go
import (
    "github.com/aquasecurity/trivy/pkg/types"
    "github.com/aquasecurity/trivy/pkg/scan"
)

// Configure for SBOM-only decoding:
opts := types.ScanOptions{
    Scanners: types.Scanners{types.SBOMScanner},
}

// Decode SBOM without live scanning:
result, err := scan.ScanFile(context.Background(), "path/to/bom.json", opts)

```

This configuration skips the `ospkg.Scanner` and `langpkg.Scanner` entirely, treating the input strictly as an SBOM document.

## Summary

- The **vulnerability scanner** requires live artifact access to detect CVEs, secrets, and misconfigurations using OS and language-specific detectors.
- The **SBOM scanner** is a virtual component that decodes existing SBOM files (CycloneDX, SPDX) and cannot be manually enabled via `--scanners`; it activates automatically when package lists are required.
- In [`pkg/scan/local/service.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/scan/local/service.go), the `AnyEnabled` guard clause determines whether to execute live package detection or skip directly to SBOM decoding.
- Use the vulnerability scanner for initial security assessments of containers and codebases; use the SBOM scanner workflow for re-scanning existing bills of materials or generating component inventories without security analysis.

## Frequently Asked Questions

### Can I explicitly enable the SBOM scanner using the --scanners flag?

No. According to the source code in [`pkg/types/scan.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/types/scan.go), the SBOM scanner is explicitly documented as "the virtual scanner of SBOM, which cannot be enabled by the user." Trivy enables it automatically through the `enableSBOM()` method in [`pkg/flag/options.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/flag/options.go) when you use SBOM-specific commands or output formats.

### Does the SBOM scanner detect vulnerabilities on its own?

No. The SBOM scanner only decodes existing SBOM files into Trivy's internal report structure. To detect vulnerabilities, you must enable both scanners simultaneously—typically by running `trivy sbom <file> --scanners vuln`—which allows the vulnerability scanner to enrich the decoded package list with CVE data from Trivy’s vulnerability database.

### What SBOM formats does the SBOM scanner support?

The SBOM scanner in aquasecurity/trivy supports CycloneDX (JSON and XML), SPDX (JSON and Tag-Value), and Trivy’s own JSON format. The decoding logic resides in [`pkg/sbom/io/decode.go`](https://github.com/aquasecurity/trivy/blob/main/pkg/sbom/io/decode.go), which handles format detection and normalization into Trivy’s `types.SBOM` structure regardless of the original specification.

### When should I use the SBOM scanner instead of the vulnerability scanner?

Use the SBOM scanner workflow when you need to generate a software bill of materials without security analysis (such as for compliance or inventory purposes) or when you want to re-scan a previously generated SBOM against updated vulnerability databases without accessing the original build artifacts. Use the vulnerability scanner for direct security assessments of live container images, running systems, or source code repositories.