Alternatives
StepSecurity alternatives
StepSecurity Harden-Runner adds egress control and runtime visibility to runners you keep. Teams look at alternatives when they want a package-level record of each build, or control built into the runner.
Updated
We build CRACI, so weigh that in; we describe every option from its own documentation and say when another tool fits better.
Why teams look beyond StepSecurity
Harden-Runner is an agent added as the first step of a job. It maps outbound connections, processes and file writes to each workflow step, builds a baseline in audit mode, and blocks egress to anything off an allowlist. It fully supports GitHub-hosted Linux runners and runs in audit mode on Windows and macOS.
Teams look elsewhere when their situation changes:
- Evidence. It records destinations rather than a package-level SBOM.
- Setup. The agent is a step you add to each workflow.
- Price. As of September 2026, the Community tier is free for public repositories and Enterprise is $16 per contributing developer per month.
What to look for
- Whether the tool is an agent on your runner or the runner itself.
- Egress control, and whether you can observe before you block.
- Process and file monitoring, if you need it.
- Build evidence: a package-level SBOM of what each job fetched.
- Which runners and CI systems it covers.
The options
1. CRACI (our product)
CRACI is the runner itself rather than an agent on yours. An egress policy, default deny or allow, is validated before the job starts and fails closed. While the job runs, a package-aware proxy records what it fetched and produces an SBOM with a completeness state. The API returns SBOMs, network traces and provenance.
Best for: teams that want to control and record the build in one place.
Consider if: you can move jobs to CRACI's Linux runners for GitHub Actions. CRACI does not monitor processes or file writes, and an audit mode before blocking is on its roadmap.
2. Cycode Cimon
Cimon, from Cycode, is an eBPF agent that runs inside your CI jobs. It monitors processes, network egress and file access, learns a pipeline's normal behavior before enforcing it, produces a runtime-observed SBOM and signs SLSA provenance. Cycode says Cimon is free and open source, and it sits inside Cycode's wider application security platform.
Best for: build runtime protection on runners you keep, across several CI systems.
3. Namespace
Namespace runs Linux, Windows and macOS runners on hardware it operates itself, selected through runner profiles. Cache volumes keep data on local storage across runs. Its egress policies run in block mode or in advisory mode, which records decisions without blocking so you can build an allowlist from real traffic. As of September 2026, a 2 vCPU, 4 GB Linux runner costs $0.002 per minute in plan and $0.003 in overage.
Best for: Linux, Windows and macOS runners from one vendor, with cache volumes.
Consider if: you want to trial an egress policy before enforcing it.
4. Depot
Depot offers Linux runners from 2 to 64 vCPUs, Windows, and macOS on the Startup plan and above, wired into a distributed cache. It describes its runners as "up to 3x faster than a GitHub-hosted runner." Its remote Docker build service keeps a persistent layer cache, Linux runners support egress filtering, and on the Business plan runners can live in your own AWS account. As of September 2026, 2 vCPU costs $0.006 per minute beyond plan minutes, tracked per second.
Best for: teams whose CI time is dominated by Docker image builds.
Consider if: you want remote build caching for Bazel, Gradle or Turborepo too.
5. Self-hosted runners with Actions Runner Controller
Actions Runner Controller (ARC) is "a Kubernetes operator that orchestrates and scales self-hosted runners for GitHub Actions." Runner scale sets grow and shrink with the number of workflows running, and runners can be ephemeral containers. GitHub does not charge per minute for self-hosted usage as of September 2026, but you are responsible for the operating system and software, and GitHub warns that self-hosted runners should almost never be used for public repositories.
Best for: jobs that must run in your network or on your hardware.
Consider if: you already run Kubernetes and have the time to harden and maintain it.
Managed vs self-hosted runners
Side by side
| Capability | CRACI | StepSecurity Harden-Runner | Cycode (Cimon) | GitHub Advanced Security |
|---|---|---|---|---|
| Where it runs | It is the runner | Agent on runners you keep | Agent inside your existing CI | Scans repositories on GitHub |
| Build egress control | Default deny or allow, fails closed | Allowlist in block mode | Prevent mode with allowed hosts | |
| Audit mode before blocking | Monitor or dry-run mode | Per-job baselines | Detect mode | No egress control |
| Process and file monitoring | eBPF | Not stated | ||
| SBOM recorded from the build | Per job, with a completeness state | Records destinations, processes, files | Runtime-observed SBOM | Graph from manifests, plus submitted build data |
| Signed build provenance | No signed provenance | Not stated | SLSA Provenance v1.0 | Artifact attestations |
| SAST | Not stated | CodeQL | ||
| Secret scanning | Not stated | Secret Protection | ||
| CI coverage | GitHub Actions today; GitLab CI and Jenkins on the roadmap | GitHub Actions, GitLab CI, Azure DevOps | GitHub Actions, Azure Pipelines, Jenkins, GitLab CI, Buildkite, Harness | GitHub, and Azure DevOps as a separate purchase |
| Price | $0.002 per vCPU-minute ($0.004 for 2 vCPU), runner included | Free for public repositories; Enterprise $16 per contributing developer per month | Free and open source, per Cycode | $19 Secret Protection, $30 Code Security per active committer per month |
- Included
- Partly
- Not included
- On the roadmap
"Not stated" means we could not confirm it in the vendor's public pages.
When to stay with StepSecurity
- You want to keep GitHub-hosted runners, including Windows and macOS.
- You want to watch traffic in audit mode before you block.
- You need process and file monitoring, not only network control.
- You also run GitLab CI or Azure DevOps.
Read more about runner and build security and CI/CD integration.
StepSecurity alternatives FAQ
Short answers to the questions teams ask when they compare
Is there a free alternative to Harden-Runner?
Cycode says Cimon is free and open source. It is an eBPF agent that monitors processes, egress and file access inside your CI jobs. Harden-Runner itself is free for public repositories on GitHub-hosted runners, and its community-tier agent is open source under Apache 2.0. CRACI has no free tier.
What replaces StepSecurity on Azure DevOps?
Not CRACI: it supports GitHub Actions only today, with GitLab CI and Jenkins on the roadmap. Cycode lists Azure Pipelines among the CI systems Cimon covers, and Harden-Runner itself supports Azure DevOps.
Does CRACI need an agent?
No. CRACI is the runner, so there is no agent to add to your workflows and no controller to operate. You set runs-on: craci, and the egress policy is validated before the job starts and fails closed.
How much does StepSecurity cost?
As of September 2026, the Community tier is free for public repositories on GitHub-hosted runners, and Enterprise is $16 per contributing developer per month, with a 14-day free trial. Runner minutes are a separate cost. CRACI charges only for the runner itself: $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee and no per-SBOM charge.
Can CRACI audit egress before it blocks?
Not yet. A monitor or dry-run mode is on CRACI's roadmap. Harden-Runner builds a baseline in audit mode, and Cimon learns a pipeline's normal behavior before it enforces.
Control and record one build
Run one GitHub Actions job on CRACI and see its egress policy, network trace and SBOM side by side.
Book a demo