Benchmarks

ScanRook combines multiple advisory sources and verifies against the installed package database to produce high-confidence findings:

• Installed-state verification — ScanRook reads package databases (dpkg, RPM, APK) directly instead of relying on file path heuristics. Only packages confirmed as installed are reported with ConfirmedInstalled confidence.
• Triple-source RHEL coverage — For Rocky Linux, AlmaLinux, and other RHEL-based images, ScanRook combines three sources: OSV batch queries, RHEL OVAL patch evaluation, and the Red Hat Security Data API for unfixed CVEs (will-not-fix, fix-deferred, affected). This produces 2.5x more findings than Trivy on Rocky Linux 9.
• Fixed advisory filtering — Vulnerabilities that have already been patched in the installed version are excluded. Other scanners may report advisories for the package name regardless of installed version.
• Unfixed CVE visibility — ScanRook surfaces CVEs that Red Hat has marked as "Will not fix", "Fix deferred", or "Affected" — with strict RHEL-version-specific validation to avoid false positives from historical advisories.

For example, ubuntu:24.04 shows 1,365 ScanRook findings vs 10 Trivy / 47 Grype. ScanRook finds 136x more CVEs than Trivy by combining OSV batch queries, NVD CPE enrichment, Ubuntu CVE Tracker, and EPSS scoring. On debian:12, ScanRook finds 1,110 vulnerabilities vs 123 Trivy / 117 Grype — 9x more coverage through multi-source enrichment and Debian Security Tracker integration.

• All tools run on the same machine with warm caches (second run after initial cache population).
• Container images saved via docker save to local tar files.
• ScanRook uses default settings (light mode, all enrichment sources active).
• Trivy uses trivy image --input with default settings.
• Grype uses grype [file] -o json with default settings.
• Finding counts are unique CVE IDs after deduplication.
• Raw benchmark data (JSON reports + CSV) is available in the scanner repository.

To reproduce these benchmarks yourself:

scanrook benchmark --file ./image.tar --profile warm

• Same environment — All three scanners (ScanRook, Trivy, Grype) run on the same machine, same OS, same images saved to the same directory. No scanner-specific hardware or network advantages.
• No image-specific hardcoding — ScanRook does not contain any image-specific logic or benchmark-specific cache warming. The same scanning pipeline runs for all images.
• Standard caching only — ScanRook uses its standard SHA256-keyed file cache at ~/.scanrook/cache/. No benchmark-specific pre-loading or cache seeding.
• Database differences — Trivy downloads a pre-compiled BoltDB vulnerability database (~400MB) rebuilt every 6 hours. Grype uses a pre-compiled SQLite database (~65MB) rebuilt daily. ScanRook can download a pre-compiled SQLite database via scanrook db fetch for offline scanning, or query live APIs (OSV, NVD, Red Hat) on cold scans and cache responses locally for warm scans.
• Cold vs warm scans — Published "warm cache" times represent the second scan of the same image, where API responses are served from local cache. Cold-scan times are significantly longer for ScanRook because every vulnerability query hits a live API. We are transparent about this tradeoff.
• Open source benchmark code — The run_benchmark() function in src/main.rs is open source and can be audited. Raw JSON outputs from all three tools are available for independent verification.