CRACI vs Anchore

The short answer

Anchore Enterprise is an SBOM platform for continuous security and compliance. It builds on Anchore's open-source Syft and Grype, scans container images, filesystems and imported SBOMs, and enforces policy packs for standards such as FedRAMP and NIST. CRACI is a GitHub Actions runner that records the dependencies each job actually fetched and produces the SBOM from that record, with a completeness state.

The difference is where the component list comes from: a scan of what is present, or a record of what the build did. CRACI also monitors that record for new vulnerabilities, so the CI, the SBOM and the vulnerability tracking come from one product instead of a runner plus a scanning platform.

At a glance

What Anchore does well

Start with the open-source tools, because they are separate from the commercial product. Syft is a CLI and Go library that generates SBOMs from container images and filesystems, under the Apache 2.0 license. Grype is an open-source vulnerability scanner for images and filesystems. Many teams already run one or both for free.

Anchore Enterprise "builds on open source Syft and Grype" and adds what large organizations need around them:

• Broad coverage. Container, source code and filesystem SBOMs, plus SBOMs created outside the platform. Uploaded SBOMs are validated for schema correctness before analysis. Version 6 added virtual machines and remote filesystems.
• Continuous scanning. Stored SBOMs are rescanned for vulnerabilities without the original artifact, and the platform also looks for secrets and malware.
• Policy as code. Policy gates with prebuilt packs, including FedRAMP, NIST, CIS, PCI DSS and CMMC.
• Your infrastructure. Helm on EKS, AKS, GKE or OpenShift, Docker Compose, cloud images and air-gapped installs.
• Many CI systems. Documented integrations for GitHub, GitLab, Jenkins, AWS CodeBuild and Azure Pipelines.

If you run container fleets across several CI systems, or you work in a government or air-gapped environment, those are real strengths, and CRACI does not match them today.

Where CRACI is different

A record of the build, not a scan of the result

In Anchore's GitHub Actions integration, anchorectl builds the SBOM on your runner, or Anchore's analyzers build it on the server. Either way, the SBOM describes what a scanner finds in an image or a directory. Scanning the finished image is good practice. It sees what landed in the artifact. It cannot see what the job fetched along the way and left behind, such as build plugins, test tools and packages restored from a cache.

CRACI runs the job. You change runs-on to craci, and a package-aware proxy records traffic to package sources during the build: npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. Dependency evidence travels with CI caches, so a restored package stays in the record.

Why the method matters

A scanner can only report what the files in front of it declare, and what it reports depends on its settings. Syft chooses its catalogers by scan type, so the same version of the same tool can return very different lists from the same checkout depending on one flag. A repository that commits no lockfile, as express 5.2.1 does not, gives a lockfile reader nothing to resolve. This is about scanning as a method, not about Syft's quality. CRACI cannot be compared this way, because it records builds and cannot scan a directory.

A completeness state on every SBOM

Each CRACI SBOM carries a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. The state is transitive across caches. You know whether each SBOM is a full record or has a gap.

Control and provenance at the source

Because CRACI runs the job, it can enforce a network egress policy: default deny or default allow, 24 built-in software-source presets and typed custom sources. Policies are validated before the job starts and fail closed. The API returns SBOMs, network traces and provenance.

Monitoring

CRACI re-evaluates monitored SBOMs continuously and aggregates vulnerabilities across builds and repositories. Security teams can triage findings and send them to the right team. Policy gates block a build on findings.

An inventory of what is deployed where

CRACI's inventory view shows exactly which software versions are deployed to which products, globally. When a new vulnerability lands, you can see which products run the affected version instead of piecing it together from release notes and spreadsheets.

Replacing Anchore with CRACI

For teams on GitHub Actions, CRACI covers the job Anchore Enterprise does for SBOMs: it produces the SBOM in the build, keeps re-evaluating monitored SBOMs as new vulnerabilities are published, aggregates findings across builds and repositories, and lets security teams triage them and route each one to the team that owns the fix. There is no scanning platform to run and no upload step to maintain.

Be clear about what you give up. Anchore Enterprise scans container images and filesystems, including ones you did not build, and looks for secrets and malware. Its policy packs for FedRAMP, NIST and similar standards have no CRACI equivalent today, though CRACI's own policy gates block builds and enforce license policy. It also self-hosts, including in air-gapped networks, and integrates with GitLab, Jenkins and other CI systems. If those matter more than a record of what each release was built from, Anchore is the better fit.

For the Cyber Resilience Act

Anchore publishes CRA material, including an EU CRA page and an SBOM requirements guide. It positions Anchore Enterprise for SBOM management, vulnerability monitoring against sources including CISA KEV, support for the 24-hour early warning and 72-hour notification windows, policy gates, VEX annotations and audit trails.

The CRA's reporting obligations apply from September 11, 2026: an early warning within 24 hours of becoming aware of an actively exploited vulnerability, through the CRA Single Reporting Platform. Its main provisions apply from December 11, 2027. Reporting in 24 hours depends on knowing which releases contain the affected component. CRACI's API returns SBOMs, network traces and provenance, and SBOMs export as CycloneDX or SPDX, including vulnerabilities.

CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. Neither product makes a manufacturer compliant on its own. See what the CRA requires and CRA compliance with CRACI.

CRACI and Anchore: common questions

Syft and Grype, self-hosting, CI support and pricing

Is CRACI an Anchore alternative?

Yes, for teams on GitHub Actions. CRACI produces the SBOM in the build, keeps re-evaluating monitored SBOMs as new vulnerabilities are published, and lets security teams triage findings and route them to the team that owns the fix, with no scanning platform to run. Anchore is the better fit if you need to scan images you did not build, self-host, or run on several CI systems.

How is CRACI different from Syft and Grype?

Syft and Grype are Anchore's free, open-source tools: Syft generates SBOMs from container images and filesystems, and Grype scans them for vulnerabilities. Both read what is present in the files in front of them. CRACI runs the build and records the packages the job actually fetched, including packages restored from CI caches, so for the software you build it replaces both.

What does Anchore Enterprise do that CRACI does not?

Anchore Enterprise scans container images and filesystems, including ones you did not build, and looks for secrets and malware. It ships policy packs for FedRAMP, NIST, CIS, PCI DSS and CMMC, which have no CRACI equivalent today, though CRACI's own policy gates can block a build on findings. It also self-hosts, including in air-gapped networks.

Can CRACI run self-hosted or air-gapped?

Not today. CRACI offers managed runners on European infrastructure, with customer-hosted runners on the roadmap for Enterprise. Anchore Enterprise installs with Helm on Kubernetes, with Docker Compose or in air-gapped networks.

Which CI systems do Anchore and CRACI support?

Anchore documents integrations for GitHub, GitLab, Jenkins, AWS CodeBuild and Azure Pipelines. CRACI is a runner for GitHub Actions today; other CI systems are on the roadmap, GitLab CI and Jenkins among them.

How does pricing compare?

As of September 2026, Anchore Enterprise is priced on request. CRACI charges only for build minutes: $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee and no per-SBOM charge. See pricing for current terms.

Do Anchore and CRACI support VEX and the Cyber Resilience Act?

Anchore positions Anchore Enterprise for the CRA with SBOM management, vulnerability monitoring, policy gates, VEX annotations and audit trails. CRACI supports VEX too. It records what each release was built from, keeps tracking its vulnerabilities and submits CRA vulnerability notifications on your behalf, automating a significant part of the evidence your CRA process needs. Book a demo to compare a recorded SBOM with the one your current scan produces.