Most vendor benchmarks are marketing. A number appears, no method, no way to reproduce it, and the competitor conveniently comes out behind. We wanted the opposite: a number we could defend to an auditor, measured against tools you already trust, with the method written down.

So we ran a differential benchmark of SentriKat against two independent leading scanners, Grype (Anchore) and Trivy (Aqua Security), on the same real production inventory. This is what we found, and how.

Why consensus, not a single tool

The obvious way to benchmark a scanner is to compare it against one other scanner. The problem is that every scanner has its own biases: findings only it reports, packages only it names a certain way, and noise only it generates. Pick one as the reference and you inherit its blind spots.

On the host we measured, Grype reported 12 CVEs that Trivy did not, and Trivy reported 24 that Grype did not. That is exactly the individual noise you do not want to grade against.

So we did not grade against a single tool. We measured against the CVEs on which both leading scanners agree. If Grype and Trivy independently arrive at the same fixable CVE, that is a strong, low-noise reference. The metric is consensus recall: of the CVEs the reference consensus contains, how many does SentriKat also detect?

To be clear about what this is not: Grype and Trivy are the reference consensus, not ground truth. Every divergence is triaged against an authoritative source (NVD, OSV, the distribution tracker) before any number is published.

The result

On a real production inventory (Ubuntu 24.04, measured 17 July 2026):

97.3% consensus recall: of the 818 fixable OS-package CVEs that Grype and Trivy both agree on, SentriKat detects 97.3%.
96.0% of Grype’s findings reproduced, and 95.7% of Trivy’s, on the same host and the same fixed-only perimeter.

The full method, the exact perimeter, and the residual buckets are on the benchmark page.

The perimeter: fixable CVEs only

One detail matters more than any other, and it is the first thing an honest benchmark has to state: the comparison covers CVEs that have a fix available.

A distribution like Ubuntu carries thousands of CVEs marked “affected” but with no fix (wont-fix, needs-triage, deferred). Those are out of scope here for every tool, by construction. They are not actionable: there is nothing to patch yet. Mixing them in would not measure detection quality, it would measure how aggressively each tool surfaces a backlog nobody can act on. Coverage of that unfixed tail is on our roadmap via the Ubuntu CVE Tracker ingest.

Fewer false positives on backports

Here is where the numbers get interesting, and where “recall” alone would mislead you.

Distributions frequently backport a security fix into an older package version without bumping the version string. A scanner that reads the version number alone sees an “old” version and raises an alert, for a vulnerability the distribution already patched. That is a false positive.

SentriKat follows the vendor advisory, not just the version string. When the distribution has already backported the fix, we do not raise the alarm. On this inventory that shows up as a measured reduction in noise, and it is deliberate. It is not a gap in detection, it is detection that knows the difference between “old version” and “actually vulnerable”.

This is the part a single-tool comparison hides: some of what the other scanners report is exactly the backport noise we correctly suppress.

Full transparency: what is still in triage

The 2.7% that is not consensus is two small buckets, and we show them because a benchmark you cannot inspect is not a benchmark:

20 late matches. Almost all very fresh 2026 CVEs. This points to feed timing, not the matcher, which means the number can only rise as the feed catches up.
27 not yet in the catalog. CVEs not yet in our knowledge base, a coverage question we track against the feed broker for completeness.

Neither bucket is a silent failure. Both are known, both are tracked, and both move the number in one direction: up.

Reproducible by design

Same inventory the SentriKat agent already reported for that host. Same fixed-only perimeter for every tool, so no scanner is credited for the unfixed tail. Comparison on the CVE axis, so it does not matter that each tool names packages differently. Every divergence triaged against an authoritative source before the number is published.

Same inputs, same result. That is the whole point.

See it on your own inventory

The honest version of “trust us” is “verify it”. SentriKat is free during Early Access, cloud or on-premises. Run it next to the scanners you already trust, on your real environment, and compare.

Read the full benchmark method and numbers, or join Early Access.

How We Benchmarked SentriKat Against Grype and Trivy