Use when container images need one scanner for vulnerabilities, secrets, misconfigurations and licenses: trivy image with severity filters, SARIF or JSON output, .trivyignore suppressions, --ignore-unfixed and scanner toggles. For a standalone SBOM use syft-generation.