CRACI vs ReversingLabs Spectra Assure

The short answer

ReversingLabs Spectra Assure analyzes compiled software packages, without source code, for malware, tampering, exposed secrets, suspicious behavior and vulnerabilities, and produces an SBOM from what it finds. CRACI is a GitHub Actions runner that records what each build pulls in while it runs, controls what the build can reach, signs provenance for the result, and keeps monitoring what shipped. Spectra Assure is the final exam for the output; CRACI is the record of the build. Both address software supply chain risk, from opposite ends, and they fit together well.

At a glance

What Spectra Assure does well

Deep analysis of the finished package. Spectra Assure uses static binary analysis to process large and complex software packages without source code. Its file type support covers more than 70 archive formats, many installer types and more than 200 executable packers, and every file receives a classification: goodware, suspicious, malicious or unknown.

Malware and tampering. This is ReversingLabs' home ground. Spectra Assure uses 16 proprietary malware detection engines backed by a threat intelligence database that ReversingLabs says covers 400 billion files. Built-in differential analysis compares versions and flags suspicious changes and indicators of tampering, which is how you catch an unexpected behavior change in a release you built yourself.

SBOMs and more. The SAFE report combines an SBOM with a risk assessment. The CLI exports CycloneDX 1.6 and SPDX 3.0.1, and ReversingLabs also generates ML-BOM, CBOM and SaaSBOM views of the same package.

Software you did not build. Because it works on binaries, Spectra Assure can assess commercial and third-party software before you deploy it, and the free Spectra Assure Community checks widely used open-source packages and developer tools.

Fits into release pipelines. The rl-secure CLI runs on premises and in CI, and a hosted Portal manages projects and versions. Official integrations cover GitHub Actions, GitLab CI, Jenkins, Azure DevOps, TeamCity and JFrog Artifactory.

Where CRACI is different

A binary scan works backward from the finished package. CRACI works forward from the build, because it is the machine the build runs on.

The build is the source of truth

With a one-line change to runs-on, your workflow runs on CRACI. A package-aware proxy records what each job downloads from package sources across npm, PyPI, RubyGems, Cargo, Go, Nix, OCI and OS packages, and packages restored from CI caches are carried forward. Each SBOM states how complete it is, per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. That includes what the build fetched and used but did not ship, such as build tools and test dependencies, which a scan of the output does not see.

Control over what the build can reach

An egress policy at the runner decides which hosts a job may connect to. It is validated before the job starts, fails closed, and sends an email alert on a violation. A post-build scan can find a malicious payload in the output; an egress policy can stop a compromised dependency from reaching an unapproved host during the build.

Provenance and monitoring

Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to the build that produced it, and the API traces an artifact to its build, CycloneDX SBOM and job network trace. CRACI keeps re-evaluating monitored SBOMs as advisories appear.

What CRACI does not do matters just as much. It does not analyze binaries, detect malware or compare the behavior of two releases. If a build step injects code into the output, CRACI's record shows what the build fetched and where from, but a binary scan is what inspects the result.

When to use which, and when to use both

• You deploy commercial or third-party software. Spectra Assure. CRACI can only record builds that run on it.
• You need proof of what went into each release. CRACI. The record comes from the runner, with completeness stated and provenance signed.
• You want a release gate for malware and tampering. Spectra Assure. Run it on the artifact before you publish.
• You want both views of a release. Build on CRACI and run the Spectra Assure scan as a step in the same workflow. CRACI answers "what went into this build"; Spectra Assure answers "what is in this package". Where the two disagree, you have something to investigate.

For the CRA

The Cyber Resilience Act asks manufacturers to document the components in their products, including an SBOM, and to handle vulnerabilities for as long as a product is supported. Reporting of actively exploited vulnerabilities applies from September 2026. ReversingLabs lists the CRA among the regulations its SBOM capabilities support, and its analysis of the package you place on the market is useful evidence. CRACI adds per-build evidence of what went into that package, with provenance, ongoing monitoring and report export in PDF, HTML, CSV, Excel and JSON. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process; neither tool makes a product compliant on its own. Read what the CRA requires.

Adding CRACI alongside Spectra Assure

Keep your Spectra Assure scan step. Move the release job to a CRACI runner by setting runs-on: craci, and the same workflow keeps running in GitHub Actions while CRACI records the build. The ReversingLabs GitHub Actions are ordinary workflow steps, so the scan stays in the same job; if you set an egress policy, allow the hosts the scanner needs. CRACI supports GitHub Actions only today, so GitLab, Jenkins or Azure DevOps pipelines would need to move to use CRACI runners. See how CRACI works for consumer electronics and SaaS.