CRACI vs Safeguard

The short answer

Safeguard sells a software supply chain security platform. Its site says it finds vulnerabilities, including ones that have no CVE yet, filters them with reachability analysis, and has its Griffin AI models write the patch, run your CI and merge the pull request under your policy. It generates SBOMs in CycloneDX and SPDX, records SLSA provenance, maps evidence to compliance frameworks and runs in the cloud, on-premise or air-gapped. It does not run builds: its CLI runs in the CI you already have.

CRACI competes for the same supply chain budget from a different place. It is the runner for GitHub Actions: it records the packages each job actually pulled in, enforces an egress policy while the job runs and keeps monitoring what shipped. Safeguard covers more ground around the code; CRACI goes deeper on the build and what came out of it.

At a glance

Safeguard's column reflects what its own site and documentation state, checked on September 29, 2026. "Not stated" means we could not confirm it there.

What Safeguard does well

• Fixes, not just findings. Safeguard says Griffin AI proves reachability, authors a compatible upgrade, runs your CI and regression suite in a sandboxed branch, and merges under your policy gates. Every paid plan includes a monthly allowance of fix pull requests.
• Reachability first. Findings are filtered to vulnerable code your application can actually reach, which keeps the queue short.
• Beyond dependencies. Its CLI also reports secrets and misconfigurations as SARIF, which shows up in the GitHub code scanning tab, and the platform describes scanning source, IaC and containers.
• Hardened components. A public Gold directory and registry of hardened images and packages, so teams can start from components with no known CVEs.
• Supplier risk. A Third Party Risk Manager scores vendors and verifies the SBOMs they supply, and a Portal publishes your SBOMs to customers.
• CI breadth, deployment options and a free plan. Its documentation covers GitHub Actions, GitLab CI/CD, Jenkins and Azure DevOps. It offers on-premise and air-gapped deployment on its Sovereign tier, publishes self-serve prices and has a free plan with no card required.

Where CRACI is different

Recorded from the build, not scanned afterwards

Safeguard's documentation says its CLI runs Syft and Grype, and that it builds SBOMs from connected repositories, container images and uploaded manifests such as package.json and requirements.txt. That is the standard way to build an SBOM: read the files and work out what went in. CRACI sees the traffic coming into each build instead. A package-aware proxy records every package the job fetched across npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets, and packages restored from CI caches stay in the record.

That is how CRACI records the hidden dependencies that lockfile-based tools miss: code downloaded by npm install hooks, Rust build scripts that fetch at build time, and the base image layers of a container build. Every SBOM carries a completeness state per job and per cache (Complete, Complete with connections, Incomplete, Unavailable or Not recorded), so when the record has a gap, it says so.

Control while the build runs

A scanner reports what it finds after the fact. Because CRACI is the runner, it decides which hosts a job may reach while it runs. Egress policies are default deny or default allow, with 24 built-in software-source presets and typed custom sources, validated before the job starts, and they fail closed. With a default-deny policy, a compromised package that tries to send your secrets to an unknown host is blocked, even in an attack nobody has seen before, and CRACI alerts you about the violation.

Provenance and monitoring from one record

Safeguard says it generates, stores and verifies SLSA provenance. CRACI's provenance comes from the runner the job ran on: the API returns SBOMs, network traces and provenance. CRACI does not sign provenance and claims no SLSA level. It keeps re-evaluating the SBOMs of what you shipped as new vulnerabilities are published, and shows every past build that contained a vulnerable dependency, so you know how long you were exposed.

The runner is part of the product

Because CRACI is the runner, the evidence comes with compute: runs still appear in GitHub, and CRACI runs builds about twice as fast as GitHub-hosted runners, thanks to faster hardware, shorter queue times and caching. CRACI charges only for build minutes, $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee and no per-SBOM charge. See CRACI pricing.

Which one fits

Safeguard is the better fit when

• You want fix pull requests written, tested and merged for you.
• You want reachability analysis and secrets and misconfiguration findings in the same platform.
• You build on GitLab, Jenkins or Azure DevOps.
• You need on-premise or air-gapped deployment today.
• You want a hardened component registry or supplier risk scoring alongside your SBOMs.

CRACI is the better fit when

• You build on GitHub Actions and want the runner, egress policy and dependency record in one place.
• You need an SBOM of what each build actually fetched, with a completeness state you can show an auditor.
• You want monitoring of what shipped and build history from the same record.

Replacing Safeguard with CRACI

For the software you build on GitHub Actions, CRACI takes over the SBOM and monitoring job: it records the SBOM in the build with a stated completeness, keeps re-evaluating monitored SBOMs, aggregates findings across builds and repositories, and lets security teams triage them and route each one to the team that owns the fix. Policy gates can block a build on findings, including a specific CVE.

Be clear about what you give up. CRACI opens no fix pull requests, has no reachability analysis, does not scan for secrets or misconfigurations, offers no hardened component registry, has no signed provenance or SLSA level, does not detect new malicious packages by behavior (it flags known malicious releases once an advisory with a CVE is published), and has no on-premise or air-gapped option today. It runs GitHub Actions only, with GitLab CI and Jenkins on the roadmap. If automated remediation or those deployment options matter more than a record of what each release was built from, Safeguard is the stronger fit.

What to check before you buy any SBOM tool

These questions apply to every vendor in this category, CRACI included.

• How is the SBOM produced? Ask which tool generates it and from what: lockfiles and manifests, a scan of the finished image, or a record of the build. Then run it on one of your own builds and compare the component lists, including transitive dependencies.
• Check certifications with the issuer. A certificate or authorization can be confirmed with the body that issued it, and "designed for" or "aligned with" a framework is not the same as holding it. Safeguard's security page describes its architecture as designed for FedRAMP High and IL5 and its SOC 2 Type II audit as in progress; consistent with that wording, Safeguard was not listed on the FedRAMP Marketplace when we checked on September 29, 2026. CRACI holds ISO/IEC 27001 certification from Into Certification, with details in its Trust Center.
• Ask for references. Safeguard's site describes its customers anonymously, under NDA. Whichever vendor you consider, CRACI included, ask for a reference call with a team like yours.
• Confirm the price in writing. Published prices change. Safeguard's pricing page notes that its figures are proposed pending final sign-off.

SBOM requirements

Several frameworks ask for an SBOM and a way to handle vulnerabilities in it: US Executive Order 14028 shapes federal procurement guidance around SBOMs, FDA section 524B requires one for cyber devices, and the EU's Cyber Resilience Act asks manufacturers to document their components. CRACI automates a significant part of the supply chain visibility and evidence those processes need: build-time SBOMs exported as CycloneDX or SPDX, vulnerability tracking, and provenance through the API. See CRA evidence. Neither tool makes a product compliant on its own.

For other tools in this space, see CRACI vs Anchore, CRACI vs Syft and Grype and SBOM tools compared.

Safeguard questions, answered

What is Safeguard?

Safeguard (Safeguard.sh Inc, Dublin, California, according to its site) sells a software supply chain security platform. Its site describes SBOM generation in CycloneDX and SPDX, SLSA provenance, reachability analysis, AI-authored fix pull requests from its Griffin models, third-party risk management, a registry of hardened components and deployment in the cloud, on-premise or air-gapped.

How does Safeguard generate SBOMs?

According to its documentation, Safeguard builds SBOMs from connected repositories, container images and uploaded package manifests, and its CLI (safeguard scan) runs Syft and Grype in your pipeline. Its comparison with Anchore lists its SBOM as CycloneDX and SPDX "via Syft". CRACI does not scan: it runs the build and records the packages each job fetched.

Does Safeguard provide CI runners?

No. Safeguard's CI documentation shows its CLI running inside GitHub Actions, GitLab CI/CD, Jenkins and Azure DevOps pipelines that you operate, and notes that the CLI reports findings without failing the build; enforcement happens in the platform's policy gates. CRACI is the runner: GitHub Actions jobs run on CRACI, which records what each job fetched and controls what it can reach.

How much does Safeguard cost?

As of September 2026, Safeguard's pricing page lists a free plan with 5 fix pull requests, 100 scanned components and 100 MCP tool calls a month; individual plans at $9, $25, $49 and $99 a month; Team plans at $19, $49 and $99 per user a month, with a two-user minimum; and Business, Enterprise and Sovereign by quote. Compliance packs are $2,099 per framework per year. The page notes that its figures are proposed pending final sign-off, so confirm current prices with Safeguard. CRACI charges only for build minutes: $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second.

Can CRACI replace Safeguard?

For the SBOMs, provenance and vulnerability monitoring of software you build on GitHub Actions, yes: CRACI produces the SBOM from the build itself and keeps monitoring it. CRACI does not replace Safeguard's AI fix pull requests, reachability analysis, secrets and misconfiguration detection, hardened component registry or air-gapped deployment, and it runs GitHub Actions only today, with GitLab CI and Jenkins on the roadmap.