CRACI vs Checkmarx One

The short answer

Checkmarx One is an application security platform: static analysis, software composition analysis (SCA), secrets detection, IaC, API security, container security, malicious package protection and posture management in one place. CRACI is a GitHub Actions-compatible CI runner that records every external dependency a build pulls in, and produces the SBOM, provenance and compliance evidence from that record. Checkmarx One is a scanner, with many engines. CRACI is a recorder. They overlap on SBOMs and vulnerability tracking, and little else.

At a glance

What Checkmarx One does well

Breadth. Checkmarx One covers first-party code (SAST), secrets, infrastructure as code, APIs, containers, open-source dependencies, repository health and AI components, and brings the findings together in its ASPM layer. If you want one vendor for application security testing, CRACI is not a substitute. It does not test your code at all.

Knowing which vulnerabilities matter. Checkmarx SCA uses exploitable path analysis to determine which vulnerable classes or functions in third-party libraries your code may call. It scans direct and transitive dependencies, including private packages, to unlimited depth. Policies on severity, reachability, malicious code and licenses can send alerts, prevent pull requests and break builds.

Malicious packages. Checkmarx maintains a large proprietary database of malicious open-source packages, covering typosquatting, dependency confusion and compromised accounts, and can block a build automatically when one shows up in your dependency tree.

SBOMs and integrations. Checkmarx One exports SBOM reports in CycloneDX 1.7 or SPDX 2.3, with optional VEX triage data in CycloneDX, and can ingest SBOMs. It has plugins for Jenkins, TeamCity, GitHub Actions, Azure DevOps and Maven, and uses its CLI for GitLab, Bitbucket Pipelines, CircleCI, Bamboo and AWS CodeBuild. For Code Repository Integration projects it can open an automatic pull request with remediated package versions; its release notes listed npm package.json manifests at launch.

Where CRACI is different

What the scanner sees, and what the build did

The Checkmarx One GitHub Action wraps the Checkmarx CLI, which creates a zip archive of your source repository and uploads it for scanning. SCA Resolver can instead extract dependencies and fingerprints on premises, with your own package managers, and send them for analysis without your source code. Either way, the analysis starts from the project: its code, manifests and the dependency tree they resolve to.

CRACI starts from the build. It is the runner, so a package-aware proxy observes what the job actually downloads from package sources: npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. That includes toolchains, base images, release downloads and packages restored from CI caches. Each SBOM states its completeness per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Control, not only detection

Because the build runs on CRACI, you can set an egress policy for it: default deny or default allow, 24 built-in software-source presets, and typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git. Policies are validated before the job starts and fail closed. Checkmarx judges packages by what they are. CRACI limits where a build can fetch from. CRACI does not detect malicious packages by reputation, so the two layers complement each other.

Provenance and monitoring

The API returns SBOMs, network traces and provenance. CRACI aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

An inventory of what is deployed where

CRACI's inventory view shows exactly which software versions are deployed to which products, globally. When a new vulnerability lands, you can see which products run the affected version instead of piecing it together from release notes and spreadsheets.

When to use both

• Security testing plus release evidence. Checkmarx One in pull requests for code, secrets, IaC and dependency risk. CRACI as the runner for release builds, holding the SBOM and provenance data for each build.
• Supply chain defense in layers. Checkmarx malicious package protection flags bad packages. CRACI egress policy keeps builds on approved sources and records every fetch.
• Pipelines outside GitHub Actions. Checkmarx One fits Jenkins, TeamCity, Azure DevOps and GitLab today. CRACI supports GitHub Actions only today, with GitLab CI and Jenkins on the roadmap, so those pipelines would need to move first.

For the Cyber Resilience Act

Checkmarx offers a CRA assessment as part of its AppSec Program Maturity Assessment (APMA), which measures security-by-design practices and vulnerability management against CRA requirements for connected products. Its blog argues that AppSec is becoming the technical implementation layer for CRA compliance, with particular attention to documenting AI components through AI-BOMs.

CRACI adds evidence from the build: what went into each release, how complete the record is, and continuous monitoring afterward, with SBOMs that export as CycloneDX or SPDX. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. Neither tool makes a product compliant on its own. See CRA compliance and CRA evidence.

Adding CRACI alongside Checkmarx One

CRACI replaces the runner, not GitHub Actions. Change runs-on to craci in a workflow and runs still appear in the GitHub UI. The Checkmarx One GitHub Action stays in the workflow as a step. Start with one release pipeline and compare CRACI's SBOM with the Checkmarx One SBOM report for the same commit.

Weighing more than two tools? Checkmarx alternatives compares nine options side by side.