Trivy can inspect dependencies, container images, and infrastructure configuration. Comparing scanners by total alert count rewards noise, not security.
Build a small test repository with a known outdated library, a container base image, and one intentional configuration error. Scan it in each candidate. Check whether findings identify the affected component and fixed version, whether false positives can be documented, and whether the CI job fails only for the severity and policy you selected. Repeat after applying a fix. Record scan time, database update behavior, and whether private code or manifests leave your environment.
Keep a baseline report in a safe location. The best scanner is the one that helps a maintainer make the correct fix with predictable CI behavior.
Akousa