104% more reported CVEs per day in 2026 than last year.

Compare

AI and security

Where AI helps, and where you need deterministic evidence.

Updated

An inferred answer or a recorded one Asked what went into a build, an AI tool infers an answer from code and files; the answer can vary between runs and cannot show what it missed. A deterministic record from the build lists what the job fetched, gives the same record for the same build, and states its own completeness. Used together, AI works on the accurate record, for example to triage findings or write fix pull requests. What went into this build? AI-generated answer Inferred from code and files Can vary between runs Cannot show what it missed A guess, not evidence Deterministic record Recorded by CRACI during the build What the job fetched Same build, same record States its completeness Use both AI triages findings and writes fix pull requests on top of the accurate record

Each comparison says what the other product does well, where CRACI is different, and when you would use both. For every category, see all comparisons.

Two layers, two jobs

Most security teams are adding AI already: to review code, to triage findings and to write fixes. That is a good use of it. The question is what the AI works from. A security program needs two layers:

  • An AI layer that reads, explains and acts: code review, triage, and fix pull requests.
  • A record layer that says what actually happened: which dependencies each build fetched, recorded the same way every time, and stating where the record is incomplete.

AI works best on top of the record. The rest of this page, and the guides below, cover where each layer is strong.

Three tests for security data

Security data that leaves the engineering team, in an audit, a customer questionnaire or a CRA report, has to pass three tests.

  • Reproducibility. Ask the same question twice and get the same answer. A model's output can vary between runs; a record of the build does not.
  • Auditability. Show how you know. A record points at the build it came from; an inferred answer cannot show its working in the same way.
  • Completeness. You cannot report what you never saw. Neither an AI tool nor a scanner can list a dependency that was never in front of it.

Deterministic is necessary, not sufficient. SBOM generators are deterministic and still disagree with each other, so what closes the gap is observation: recording what the build pulled, and saying when the record is incomplete. CRACI marks every job and cache as Complete, Complete with connections, Incomplete, Unavailable or Not recorded. AI vs deterministic security, with a worked example

Where AI does well

  • Code review: the reading work a busy reviewer skips, as comments and suggestions on pull requests.
  • Triage: explaining an advisory in plain language and ranking what to look at first.
  • Fixes: writing the change, adapting code to a breaking upgrade, and opening the pull request. Whether those fixes help depends on what the AI is told to fix. AI vulnerability remediation
  • Working with a recorded SBOM: summarizing which components carry risk and drafting the documentation around it for a human to review.

Where you need a record

  • "Are we affected?" When a new advisory lands, the answer has to cover every build that pulled the package, not the ones a model or a scan happened to look at.
  • Dependencies an AI added. AI coding assistants add dependencies, and sometimes name packages that do not exist. A record of the build shows what was actually downloaded.
  • Audits and customer questions. An auditor or customer wants evidence they can check, not a description.
  • SBOMs under the CRA. An AI-generated SBOM is a guess about your build; the Cyber Resilience Act and the 2026 CISA minimum elements expect a record. Why an AI-generated SBOM is not evidence

The rule is simple: let the build produce the record, and let the AI read it. How AI security tools and CRACI fit together

CRACI compared with each tool

AI and security, answered

Can an AI tool write my SBOM?

It can write something that looks like one, quickly. But a model works from the code and files it is shown, not from what the build fetched, and hallucination is a documented failure mode. Regulators and customers ask for a record of what the product contains. Let the build produce the SBOM, and let the model read it.

Do AI security tools replace SCA or build evidence?

No. AI code review, triage and fix pull requests are useful additions to a security program, but they work best on top of data that is complete and repeatable. The two layers do different jobs, and most teams need both.

Is a deterministic scanner enough?

Deterministic is necessary, not sufficient. SBOM generators are deterministic and still disagree with each other, because each decides for itself what counts as a component. A deterministic scanner can reproduce the same incomplete answer every time. What closes the gap is recording what the build actually pulled, and saying when the record is incomplete.

Where does CRACI sit?

In the record layer. CRACI replaces the GitHub Actions runner, and a package-aware proxy records what each job fetched while it runs. The output is an SBOM of what the job pulled, a completeness state for each job and cache, and a network trace. The API returns SBOMs, network traces and provenance. AI tools can work on top of that record.

Other categories

See CRACI on your own pipeline

Book a demo and we will walk through your builds, your SBOMs and your compliance evidence.

Book a demo