Trivy and Grype find your CVEs, then the JSON scrolls off the terminal and nobody tracks what got fixed. Ephor is the open-source layer that comes next: a dashboard, triage workflow, and remediation tracking for Kubernetes vulnerabilities. Self-hosted, your scan data never leaves your cluster.
The Ephor dashboard — severity breakdown, triage queue, remediation status.
CLI tools find vulnerabilities. Enterprise platforms manage them — at $50,000 to $500,000 per year. Between them: nothing. Until now.
Trivy, Grype, Syft
Self-hosted, unlimited
Prisma Cloud, Wiz, Aqua
Ephor keeps an index of every package in every image SBOM it has seen. When a critical CVE shows up in one image, Ephor checks the exact same package and version against the rest of your fleet and flags the images carrying it that nobody has scanned yet. You learn a vulnerable dependency is spreading on its way in, not a scan cycle later.
Severity breakdowns and trend charts across every cluster, namespace, and workload. One screen, full picture.
Filter by image, namespace, cluster, or severity. Get from 10,000 CVEs to the five that matter.
Assign, track, and manage vulnerability status with comments and full audit trails.
Flag critical findings and route them to the team that owns the workload.
Track fixes against SLAs. Measure remediation progress, not just vulnerability counts.
The Ephor Scanner discovers Kubernetes workloads and scans container images automatically using Trivy.
No venture capital. No investor pressure to enshittify the product. No exit strategy. Just the tooling.
Self-hosted by default. Your vulnerability data never leaves your infrastructure. No SaaS dependency, no third-party access, no data residency concerns.
No telemetry, no analytics, no usage tracking. Ephor doesn't call out to anyone. The only traffic is the scanner shipping results to your own API, inside your own cluster.
Licensed under AGPL v3 — an OSI-approved open-source license. Not BSL. Not SSPL. No bait-and-switch. Inspect every line. Fork if you want. This is real open source.
Ephor is free and self-hosted. Deploy with Helm, point the scanner at your cluster, done.