CRACI vs Apiiro

The short answer

Apiiro is an application security posture management (ASPM) platform. Its Deep Code Analysis maps your software architecture from code to runtime, and its Risk Graph correlates findings from Apiiro's own scanners and from third-party tools. Its software supply chain security (SSCS) module inventories repositories and pipelines and flags risks such as weak branch protection, pipeline misconfigurations and abnormal commits.

CRACI competes for the same "secure our software supply chain" budget from a different position: it runs your GitHub Actions jobs. Apiiro reasons about what your code and pipeline configuration say will happen. CRACI records what the build did, controls its network egress, signs provenance for what it produced, and keeps watching what you shipped. A large AppSec program may run both. A team whose first need is evidence of what went into each release may start with CRACI.

At a glance

What Apiiro does well

• Architecture context without CI changes. Apiiro connects to your source code manager through an API integration and says it needs no CI/CD configuration or maintenance. Deep Code Analysis then maps APIs, sensitive data, GenAI frameworks and code ownership, refreshed on every commit and material change.
• Security for AI coding. Guardian Agent, launched in January 2026, works with AI coding assistants and adds security guidelines from your threat models, compliance policies and architecture to developer prompts, so the assistant is steered away from vulnerable code before it writes it. AI Threat Modeling followed in March 2026.
• Breadth. Apiiro lists native AI SAST, AI SCA, SSCS, secrets, infrastructure as code, API security in code, DSPM for code and AI threat modeling. CRACI does none of the code scanning in that list.
• Prioritization. The Risk Graph ingests, deduplicates and correlates findings, then chains them into "toxic combinations". Apiiro's example: a repository holding PII, built by a vulnerable pipeline, receiving commits to a branch with no required reviewers. Three medium findings become one critical risk.
• Software factory inventory. SSCS inventories repositories and CI/CD pipelines, including shadow pipelines, with contributors, permissions, plugins and dependencies. It tracks pipeline dependency vulnerabilities through their lifecycle, and guardrails can block risky commits and merges.
• Dependency analysis and fixes. AI SCA checks whether a vulnerable function is actually called, matches dependencies to deployed containers and public endpoints, detects malicious packages and enforces license policy. AutoFix delivers version bumps that Apiiro says are pre-validated for API compatibility.
• Integrations. GitHub, GitLab, Azure DevOps, Bitbucket and Perforce on the source control side, Jenkins and GitHub Actions for pipeline posture, and a long list of scanners, registries and ticketing tools.

Where CRACI is different

The build is the source of truth

Apiiro's XBOM is built by analyzing code: every package, API, AI model and license, refreshed with every code change. That is a strong picture of what your code declares and uses. A build often does more than the code says. It runs install scripts, downloads toolchains, restores caches, pulls base images and fetches release binaries.

CRACI sees that activity because it is the runner. A package-aware proxy observes traffic to package sources while the job runs, across npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a package restored from a cache is still accounted for. Every SBOM carries a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. You know when the record has a gap.

Control at the runner, not only posture

Apiiro tells you when a pipeline is misconfigured or open to tampering. CRACI limits what a build can reach while it runs. Egress policies are default deny or default allow, with 24 built-in software-source presets, typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git, and explicit TLS, TCP, UDP and ICMP rules. They are validated before the job starts and fail closed, and CRACI can email you on a violation.

Evidence that ties the artifact to the build

Signed provenance links each artifact, including OCI artifacts, to the build that produced it, using Ed25519 over SHA-512. No SLSA level is claimed. Through the API you can go from an artifact to its producing build, its CycloneDX SBOM and the job's network trace.

After it ships

CRACI keeps re-evaluating the SBOMs of what you shipped as new vulnerabilities are published, and aggregates findings across builds and repositories.

Where Apiiro is ahead

To be plain about it: CRACI has no SAST, secrets, IaC or API security scanning, does not ingest other scanners' findings, does not audit branch protection or repository permissions, and supports GitHub Actions only. Build blocking on vulnerability thresholds and license policy enforcement are on CRACI's roadmap. If you need one platform that prioritizes risk across all of your code, Apiiro covers far more ground.

Which one fits

Apiiro is the better fit when

• You want a single ASPM platform across many scanners, repositories and SCM systems.
• Your priority is architecture context: which code is internet facing, handles PII or changed materially.
• You need repository and pipeline posture across GitLab, Azure DevOps, Bitbucket or Jenkins.

CRACI is the better fit when

• You build on GitHub Actions and want the runner, egress policy and dependency record in one place.
• You need an SBOM of what each build fetched, with a completeness state you can show an auditor.
• You want signed provenance, monitoring of what shipped and CRA evidence.

Using both

Apiiro now describes itself as securing agentic development. Its Guardian Agent steers AI coding assistants toward secure code before it is written, and its XBOM comes from analyzing the code in your repositories. CRACI is CI/CD with the security built into the runner, so its SBOM records what each build actually fetched, including what code analysis cannot see: install scripts, toolchains, cached packages and base images. Apiiro works where code is written, CRACI where it is built and shipped. CRACI replaces the runner, not GitHub Actions, so any Apiiro pipeline integration keeps working.

For the Cyber Resilience Act

The Cyber Resilience Act asks manufacturers to know the components in each product, handle vulnerabilities in them, and keep evidence. An ASPM platform helps with secure development and with handling vulnerabilities in your code. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs, vulnerability tracking, provenance and reports in PDF, HTML, CSV, Excel and JSON. Neither tool makes you compliant on its own. See CRA compliance.

Adding CRACI

Install the CRACI GitHub App on your organization, then change the runner label on a job to runs-on: craci. Runs still appear in the GitHub UI. Start with one workflow that produces a release artifact and compare CRACI's SBOM with your current inventory. Read more about CI/CD integration, build-time SBOM generation and pricing.