> Tools like trivvy make it possible to do the scans...

Only if you didn't rip trivvy out of your organisation when it had two supply chain compromises within a month of each other earlier this year