104% more reported CVEs per day in 2026 than last year.

Compare

CI/CD security tools compared

CI/CD security tools fall into four groups: scanners that read your code, tools that harden the pipeline around it, agents that watch the runner, and runners that control and record the build. Here is what each group covers and where CRACI fits.

Updated

Where CI/CD security tools act Scanners read the code in the repository, and pipeline hardening checks its workflow files. Each build then runs on a runner. On a runner you keep, an added security agent watches network, processes and files and can block egress in block mode. The CRACI runner is the runner itself: a default-deny egress policy controls what the job can reach, and it records the SBOM and provenance. Under both, a request to the npm registry is allowed and a request to an unknown host is blocked. Repository src/ package.json .github/workflows/ Scanners read the code Pipeline hardening checks workflows each build runs on a runner Your existing runner build job + security agent Watches network, processes and files; can block egress in block mode CRACI runner build job SBOM Provenance Is the runner: default-deny egress policy, records what each job fetched npm registry unknown host allowed blocked npm registry unknown host allowed blocked

Each comparison says what the other product does well, where CRACI is different, and when you would use both. For every category, see all comparisons.

Why the pipeline needs its own security tools

A CI/CD pipeline holds credentials, fetches code from the internet, and produces the artifacts your customers run. That makes it a target in its own right. An attacker who can change what a build downloads, or what it produces, does not need to touch your source code at all. Code scanners were not built for that, because they read the repository, not the build.

CI/CD security tools close that gap from different directions. Some check how the pipeline is configured, some watch what happens on the runner while a job runs, and some control the runner itself. Knowing which group a tool belongs to tells you more than its feature list, because it decides what the tool can see and what it can stop.

Types of CI/CD security tools

Scanners that read your code

Static analysis (SAST), secret scanning and software composition analysis (SCA) read the repository: source files, manifests and lockfiles. GitHub Advanced Security, for example, combines CodeQL code scanning with secret scanning and push protection, and Dependabot alerts from the GitHub Advisory Database. These tools find problems before a build runs. They do not see what the build actually fetched or where it connected.

Tools that harden the pipeline around the build

Posture and governance tools check the pipeline's configuration. Cycode monitors CI/CD security policies, configurations and governance. StepSecurity keeps an inventory of the third-party actions you use, with approval workflows for new ones, and opens pull requests that pin actions to commit SHAs and set least-privilege GITHUB_TOKEN permissions. These tools make the pipeline harder to misuse, but they work on the definition of the build rather than on the build as it runs.

Agents that watch the runner

Runtime agents run inside the job on runners you keep. StepSecurity Harden-Runner monitors outbound connections, processes and file writes, ties each one to the workflow step that caused it, and can block egress outside an allowlist. Cycode's Cimon monitors process execution, network egress and file access at the kernel level with eBPF, produces a runtime-observed SBOM and signs SLSA provenance. Agents work across many CI systems and on hosted runners, because they are added to infrastructure that already exists.

Runners that control and record the build

CRACI takes the last approach: it replaces the runner. Jobs run on CRACI with runs-on: craci, and runs still appear in GitHub. The egress policy is part of the runner, validated before the job starts, and fails closed. A package-aware proxy records every package the job fetched, including packages restored from CI caches, so each job produces an SBOM with a completeness state, a network trace and provenance data.

Side by side

CI/CD security tools compared, as of September 2026
CRACI StepSecurity Harden-Runner Cycode (Cimon) GitHub Advanced Security
Where it runs It is the runner Agent on runners you keep Agent inside your existing CI Scans repositories on GitHub
Build egress control Default deny or allow, fails closed Allowlist in block mode Prevent mode with allowed hosts
Audit mode before blocking Monitor or dry-run mode Per-job baselines Detect mode No egress control
Process and file monitoring eBPF Not stated
SBOM recorded from the build Per job, with a completeness state Records destinations, processes, files Runtime-observed SBOM Graph from manifests, plus submitted build data
Signed build provenance No signed provenance Not stated SLSA Provenance v1.0 Artifact attestations
SAST Not stated CodeQL
Secret scanning Not stated Secret Protection
CI coverage GitHub Actions today; GitLab CI and Jenkins on the roadmap GitHub Actions, GitLab CI, Azure DevOps GitHub Actions, Azure Pipelines, Jenkins, GitLab CI, Buildkite, Harness GitHub, and Azure DevOps as a separate purchase
  • Included
  • Partly
  • Not included
  • On the roadmap

"Not stated" means we could not confirm it in the vendor's public pages. For the detail behind each column, see CRACI vs StepSecurity, CRACI vs Cycode and CRACI vs GitHub Advanced Security.

Which tool covers which CI/CD risk

The OWASP Top 10 CI/CD Security Risks is the most widely used list of what can go wrong in a pipeline. Its ten risks are:

  1. CICD-SEC-1: Insufficient Flow Control Mechanisms
  2. CICD-SEC-2: Inadequate Identity and Access Management
  3. CICD-SEC-3: Dependency Chain Abuse
  4. CICD-SEC-4: Poisoned Pipeline Execution (PPE)
  5. CICD-SEC-5: Insufficient PBAC (Pipeline-Based Access Controls)
  6. CICD-SEC-6: Insufficient Credential Hygiene
  7. CICD-SEC-7: Insecure System Configuration
  8. CICD-SEC-8: Ungoverned Usage of 3rd Party Services
  9. CICD-SEC-9: Improper Artifact Integrity Validation
  10. CICD-SEC-10: Insufficient Logging and Visibility

No single tool covers all ten. These are the four where CRACI's controls apply:

OWASP CI/CD risks CRACI addresses
What the risk is about What CRACI does
CICD-SEC-3: Dependency Chain Abuse A build pulls in a malicious or unexpected package Egress policy limits the sources a job can fetch from, and the job's SBOM records every package it fetched
CICD-SEC-7: Insecure System Configuration Weak settings in the systems that run the pipeline Jobs run in isolated virtual machines, and a policy that cannot be applied fails closed
CICD-SEC-9: Improper Artifact Integrity Validation A tampered artifact moves through the pipeline as if it were legitimate No signed provenance; the API returns provenance data for each build
CICD-SEC-10: Insufficient Logging and Visibility Attacks in the pipeline go unseen and cannot be investigated A network trace for every job, alerts on policy violations, and an API that returns SBOMs, network traces and provenance

For CICD-SEC-7, CRACI covers the runner. The configuration of your repositories and your GitHub organization stays with you. To be plain about the rest: CRACI does not address identity and access management (CICD-SEC-2) or credential hygiene (CICD-SEC-6), and it does not govern flow control, pipeline permissions or third-party services (CICD-SEC-1, 5 and 8). Secret scanning, such as GitHub's Secret Protection or Cycode's secrets detection, and the posture tools above are built for those.

How to choose a CI/CD security tool

  • Replace your runners or keep them. If you want to keep GitHub-hosted runners, self-hosted runners or another CI system, an agent is the way to add runtime controls. If you are open to changing the runner, a runner such as CRACI brings egress control and a record of the build without an agent to deploy.
  • Audit mode today. Harden-Runner and Cimon can watch traffic before they block anything. CRACI's monitor or dry-run mode is on its roadmap.
  • Process-level forensics. If you need to know which process wrote which file during an incident, an agent that monitors processes and files covers that. CRACI does not monitor processes or file writes.
  • SBOM and CRA evidence. If you need a package-level SBOM of each build, provenance and evidence for the Cyber Resilience Act, look at what each tool records and whether it keeps monitoring what shipped. CRACI records the SBOM while the build runs, re-evaluates monitored SBOMs as new vulnerabilities appear, and exports SBOMs as CycloneDX or SPDX.
  • CI platforms and operating systems. CRACI supports GitHub Actions today, with GitLab CI and Jenkins on the roadmap, and runs Linux on x86-64 and ARM64, with Windows and macOS on the roadmap. If you build on other CI systems or need Windows or macOS runners now, check agent coverage first.
  • Code and secrets. Scanners for source code and secrets cover ground no runner does. CRACI has no SAST or secret scanning, so plan for those separately.

An agent on the runner vs being the runner

An agent is added to infrastructure someone else designed. On GitHub-hosted runners it is installed by a step at the start of each job, and its reach depends on what that infrastructure allows. That is what lets agents cover hosted runners, self-hosted fleets and several CI systems at once, and it is a real advantage when your builds are spread across all of them.

A runner that enforces policy itself works the other way round. On CRACI the egress policy is validated before the job starts, rejects unknown fields and fails closed, so a policy that cannot be applied does not produce an unprotected run. Its sources are typed by ecosystem, with 24 built-in software-source presets and custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git, so the record is of packages, not only of hosts. On jobs that run on CRACI, it replaces runtime agents rather than running next to them. Read more about CI/CD integration and build-time SBOM generation, or book a demo to see a GitHub Actions job run under an egress policy.

CRACI compared with each tool

Side by side

Several tools on one page, for when you are choosing a category, not one product.

CI/CD security tools, answered

What are CI/CD security tools?

CI/CD security tools protect the pipeline that turns source code into released software. They fall into four groups: scanners that read your code and dependencies (SAST, secret scanning, SCA), tools that harden the pipeline configuration around the build, agents that watch the runner while a job runs, and runners that control and record the build themselves. The OWASP Top 10 CI/CD Security Risks is a common way to check which risks a tool addresses.

What is the difference between CI/CD security and SCA?

Software composition analysis (SCA) reads your manifests and lockfiles and tells you which declared dependencies have known vulnerabilities. CI/CD security protects the pipeline itself: who can change it, what a build can reach, and whether the artifact you ship is the one that was built. CRACI works from the build: it records the packages each job actually fetched, including packages restored from CI caches, and keeps monitoring them for new vulnerabilities after release.

Do I need a runtime agent if I use CRACI?

Not for egress control or a record of the build. On CRACI the egress policy is part of the runner, validated before the job starts and failing closed, so CRACI replaces agents such as Harden-Runner and Cimon on the jobs that run on it. What you give up is process and file monitoring, which CRACI does not offer, and audit mode, which is on CRACI's roadmap. If process-level forensics is a hard requirement, a runner agent on runners you keep covers it today.

Can CI/CD security tools block malicious packages?

Some can, in different ways. Egress control stops a build from reaching sources outside a policy, so a download from an unexpected host fails. Package blocklists and registry controls stop a known-bad version from being installed at all. CRACI enforces an egress policy per job today, with sources typed by ecosystem; organization-wide package blocklists are on CRACI's roadmap.

Which CI/CD security tools work beyond GitHub Actions?

As of September 2026, StepSecurity lists GitLab CI and Azure DevOps alongside GitHub Actions, and Cycode's Cimon also runs on Azure Pipelines, Jenkins, GitLab CI, Buildkite and Harness. GitHub Advanced Security is also sold for Azure DevOps. CRACI supports GitHub Actions today, with GitLab CI and Jenkins on the roadmap.

Other categories

See CRACI on your own pipeline

Book a demo and we will walk through your builds, your SBOMs and your compliance evidence.

Book a demo