CRACI vs Anchore

The short answer

Anchore Enterprise is an SBOM platform for continuous security and compliance. It builds on Anchore's open-source Syft and Grype, scans container images, filesystems and imported SBOMs, and enforces policy packs for standards such as FedRAMP and NIST. CRACI is a GitHub Actions runner that records the dependencies each job actually fetched and produces the SBOM from that record, with a completeness state and signed provenance.

The difference is where the component list comes from: a scan of what is present, or a record of what the build did. CRACI also monitors that record for new vulnerabilities, so the CI, the SBOM and the vulnerability tracking come from one product instead of a runner plus a scanning platform.

At a glance

What Anchore does well

Start with the open-source tools, because they are separate from the commercial product. Syft is a CLI and Go library that generates SBOMs from container images and filesystems, under the Apache 2.0 license. Grype is an open-source vulnerability scanner for images and filesystems. Many teams already run one or both for free.

Anchore Enterprise "builds on open source Syft and Grype" and adds what large organizations need around them:

• Broad coverage. Container, source code and filesystem SBOMs, plus SBOMs created outside the platform. Uploaded SBOMs are validated for schema correctness before analysis. Version 6 added virtual machines and remote filesystems.
• Continuous scanning. Stored SBOMs are rescanned for vulnerabilities without the original artifact, and the platform also looks for secrets and malware.
• Policy as code. Policy gates with prebuilt packs, including FedRAMP, NIST, CIS, PCI DSS and CMMC.
• Your infrastructure. Helm on EKS, AKS, GKE or OpenShift, Docker Compose, cloud images and air-gapped installs.
• Many CI systems. Documented integrations for GitHub, GitLab, Jenkins, AWS CodeBuild and Azure Pipelines.

If you run container fleets across several CI systems, or you work in a government or air-gapped environment, those are real strengths, and CRACI does not match them today.

Where CRACI is different

A record of the build, not a scan of the result

In Anchore's GitHub Actions integration, anchorectl builds the SBOM on your runner, or Anchore's analyzers build it on the server. Either way, the SBOM describes what a scanner finds in an image or a directory. Scanning the finished image is good practice. It sees what landed in the artifact. It cannot see what the job fetched along the way and left behind, such as build plugins, test tools and packages restored from a cache.

CRACI runs the job. You change runs-on to craci, and a package-aware proxy records traffic to package sources during the build: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a restored package stays in the record.

Why the method matters

A scanner can only report what the files in front of it declare, and what it reports depends on its settings. Syft chooses its catalogers by scan type, so the same version of the same tool can return very different lists from the same checkout depending on one flag. A repository that commits no lockfile, as express 5.2.1 does not, gives a lockfile reader nothing to resolve. This is about scanning as a method, not about Syft's quality. CRACI cannot be compared this way, because it records builds and cannot scan a directory.

A completeness state on every SBOM

Each CRACI SBOM carries a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. The state is transitive across caches. You know whether each SBOM is a full record or has a gap.

Control and provenance at the source

Because CRACI runs the job, it can enforce a network egress policy: default deny or default allow, 24 built-in software-source presets and typed custom sources. Policies are validated before the job starts and fail closed. Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to the build that produced it.

Monitoring

CRACI re-evaluates monitored SBOMs continuously and aggregates vulnerabilities across builds and repositories. Security teams can triage findings and send them to the right team. Build blocking is on the roadmap, so for policy enforcement Anchore is ahead today.

Replacing Anchore with CRACI

For teams on GitHub Actions, CRACI covers the job Anchore Enterprise does for SBOMs: it produces the SBOM in the build, keeps re-evaluating monitored SBOMs as new vulnerabilities are published, aggregates findings across builds and repositories, and lets security teams triage them and route each one to the team that owns the fix. There is no scanning platform to run and no upload step to maintain.

Be clear about what you give up. Anchore Enterprise scans container images and filesystems, including ones you did not build, and looks for secrets and malware. Its policy packs for FedRAMP, NIST and similar standards have no CRACI equivalent today: build blocking and license policy are on CRACI's roadmap. It also self-hosts, including in air-gapped networks, and integrates with GitLab, Jenkins and other CI systems. If those matter more than a record of what each release was built from, Anchore is the better fit.

For the Cyber Resilience Act

Anchore publishes CRA material, including an EU CRA page and an SBOM requirements guide. It positions Anchore Enterprise for SBOM management, vulnerability monitoring against sources including CISA KEV, support for the 24-hour early warning and 72-hour notification windows, policy gates, VEX annotations and audit trails.

The CRA's reporting obligations apply from September 11, 2026: an early warning within 24 hours of becoming aware of an actively exploited vulnerability, through the CRA Single Reporting Platform. Its main provisions apply from December 11, 2027. Reporting in 24 hours depends on knowing which releases contain the affected component. CRACI's API takes you from an artifact to its producing build, its CycloneDX SBOM and the job network trace, and reports export in PDF, HTML, CSV, Excel and JSON.

CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. Neither product makes a manufacturer compliant on its own. See what the CRA requires and CRA compliance with CRACI.