Software supply chain security tools compared

Who this page is for

You own a "secure our software supply chain" mandate and need to decide where the budget goes. The tools below work at different points: across your repositories and pipelines, on the build runner, at the package registry, or on the finished artifact. We build CRACI, which competes directly in this category, so weigh that in. We describe every tool from its own documentation and say where another tool fits better.

What is software supply chain security?

Your software is your own code plus everything it depends on: open-source packages, base images, build tools, third-party CI actions, and the pipeline that turns them into a release. Software supply chain security is the work of knowing what those parts are, controlling where they come from, and proving what went into each release. Application security looks for flaws in the code you write; supply chain security covers what surrounds it.

Attackers go after every link. Three recent incidents show where:

• A dependency. In March 2024, malicious code was found in versions 5.6.0 and 5.6.1 of xz utils, a compression library shipped in Linux distributions (CVE-2024-3094).
• The CI pipeline. In March 2025, the tj-actions/changed-files GitHub Action was compromised (CVE-2025-30066), exposing secrets such as access keys, GitHub personal access tokens and npm tokens from the workflows that used it.
• The package registry. In September 2025, the self-replicating Shai-Hulud worm compromised more than 500 npm packages. It stole developer credentials, including GitHub tokens and cloud keys, and used them to publish more infected packages.

1:53

What types of software supply chain security tools are there?

No single product covers every link, and the vendors below mean different things by "supply chain security". Most solutions fall into one of seven types, defined by where they work.

How do you choose a software supply chain security platform?

Start from the question you cannot answer today, then pick the tool that works where that answer lives. Six questions separate the options quickly.

• Do you need breadth or depth? An application security posture management (ASPM) platform connects to your repositories, pipelines and scanners and prioritizes risk across all of them. A build-level tool goes deeper on one point: what happened while the software was built.
• Do you want to keep your runners? Agents such as StepSecurity Harden-Runner and Cycode's Cimon add monitoring to runners you already use. CRACI replaces the runner for GitHub Actions.
• Is the risk in your inputs? If you worry most about malicious packages or base images full of CVEs, tools that screen or harden inputs go straight at it.
• Do you ship software you did not build? Only binary analysis can look inside a package without its build.
• Which CI systems do you run? Most tools here cover several. CRACI supports GitHub Actions only today, with GitLab CI and Jenkins on the roadmap.
• What will you have to prove, and to whom? Customers, auditors and regulations such as the EU Cyber Resilience Act increasingly ask for an SBOM per release and a record of how vulnerabilities were handled. A dashboard of findings is not the same as evidence of what shipped.

Then ask every vendor on your shortlist the same questions:

• Where does your component list come from: manifests, source analysis, the build, or the finished binary?
• Does the SBOM tell me when it is incomplete, and does it export as CycloneDX or SPDX?
• Can you stop a build from reaching an unexpected host, or only report it afterward?
• Can I verify later that the artifact I deploy is the one that was built?
• Which source control and CI systems do you support today, and which are on the roadmap?
• What is the pricing unit: developers, contributors, images, builds or a quote?

How do the tools compare?

The tools fall into two shapes, so there are two tables. The first compares platforms and build security tools on how they see and control the pipeline. The second compares tools that work on inputs and outputs. "Not stated" means the vendor pages we cite do not say either way.

Platforms and build security

Inputs and outputs

What do software supply chain security tools cost?

Five of the nine tools below price per developer, and most sell their paid plans through sales. CRACI charges only for build minutes instead, so cost follows how much you build rather than how many people commit. Prices are as each vendor published them in September 2026; Apiiro and Legit Security are left out because their pages state no pricing.

Per-developer pricing grows with your team; build-minute pricing grows with your pipelines. CRACI's price includes the runner minutes, which replace what you pay for GitHub-hosted runners. See CRACI pricing and runner prices compared. For charts of the published prices by team size, with the runner included, see software supply chain security pricing compared.

CRACI

CRACI is a runner for GitHub Actions. You change runs-on to craci, and while each job runs, a package-aware proxy records what it fetched, including packages restored from CI caches. Each SBOM carries a completeness state per job and per cache, an egress policy is validated before the job starts and fails closed, and CRACI keeps re-evaluating the SBOMs of what shipped. Best for teams that ship software and must show what went into each release. Watch out: no SAST, secrets or IaC scanning, posture checks or binary analysis, and GitHub Actions only today (GitLab CI and Jenkins are on the roadmap). Build-time SBOM generation

Platforms and ASPM

Apiiro

Apiiro is an ASPM platform. Deep Code Analysis maps your architecture from code to runtime, and the Risk Graph correlates findings from Apiiro's own scanners and third-party tools into "toxic combinations". Its supply chain module inventories repositories and pipelines, including shadow pipelines, and flags weak branch protection and abnormal commits. It connects through APIs and needs no CI changes. Best for large AppSec programs that want architecture context across many source control systems. Watch out: its inventory comes from analyzing code, not from observing builds, and it does not control what a build can reach. CRACI vs Apiiro

Cycode

Cycode is an ASPM platform with SAST, SCA, secrets, container and IaC scanning, CI/CD posture and more than 100 connectors. Its build piece, Cimon, is an eBPF agent that runs inside your CI jobs. It monitors processes, network egress and file access, learns a pipeline's normal behavior before enforcing it, produces a runtime-observed SBOM and signs SLSA provenance. Cycode says Cimon is free and open source. Best for one platform across code and many CI systems, with build runtime protection on runners you keep. Watch out: Cimon is an agent added to your runners, not the runner itself. CRACI vs Cycode

OX Security

OX Security is an ASPM platform with its own scanners, aggregation of third-party findings from tools such as Checkmarx, Snyk and Black Duck, and CI/CD posture policies that flag unpinned actions, excessive workflow permissions and risky webhooks. Its Pipeline Bill of Materials (PBOM) is a signed record per build of pipeline definitions, runner identity, build arguments and artifact signatures. Best for posture policies and pull request gating across GitHub Actions, GitLab, Jenkins, Azure Pipelines and CircleCI. Watch out: its SBOM is collected from connected sources, and its policies check pipeline configuration rather than limit what a running job can reach. CRACI vs OX Security and OX Security alternatives

Legit Security

Legit Security maps your whole development lifecycle: a continuously updated inventory of SDLC systems, pipelines and the security controls on them, with hundreds of policies across source control, CI and registries. It orchestrates scanners such as Snyk, Checkmarx and GitHub Advanced Security, adds native SAST and SCA, finds secrets in build logs, Slack and Confluence as well as code, and creates SBOMs and signed attestations. Best for a security team that inherited many repositories and several CI systems and needs one governance layer. Watch out: it reads configuration and scanner output through APIs, so it does not see a job's network traffic while it runs. CRACI vs Legit Security and Legit Security alternatives

Kusari

Kusari comes from the team that co-created GUAC, the OpenSSF graph for supply chain metadata. Its platform builds a knowledge graph from your SBOMs, VEX documents and scanner output, shows the blast radius of a new vulnerability, analyzes reachability and opens AutoFix pull requests that it validates first. Kusari Inspector reviews pull requests for malicious packages, secrets and insecure workflows, and Kusari says it is free to install. Best for one graph across many SBOM sources and scanners. Watch out: a graph reflects the SBOMs it is fed, and Kusari's come from a generator (its waybill toolkit or your own tool) rather than from the build. CRACI vs Kusari and Kusari alternatives

Endor Labs

Endor Labs is built around function-level reachability: static program analysis traces whether your code can call a vulnerable function in a direct or transitive dependency, which Endor Labs says cuts SCA findings by 92%. Upgrade impact analysis, automated pull requests and Endor Patches, which backport fixes to the version you run, handle remediation. It also covers AI SAST, secrets, containers, a Package Firewall in front of your registries and an SBOM Hub with reachability-based VEX. Best for teams whose main problem is alert volume. Watch out: its inventory comes from analyzing source code, and it does not run or restrict your builds. CRACI vs Endor Labs

Build and runner security

StepSecurity

StepSecurity Harden-Runner is the closest overlap CRACI has with any security vendor. It is an agent on the GitHub Actions runners you already use, including GitHub-hosted ones, and it ties every outbound connection, process and file write to the workflow step that caused it. It can audit first, building a baseline per job, then block egress to anything outside an allowlist. StepSecurity also sells Secure Registry, repository hardening pull requests and Dev Machine Guard. Best for teams that want to keep GitHub-hosted or self-hosted runners, or that run GitLab CI or Azure DevOps. Watch out: its allowlist is a list of endpoints, and it records destinations rather than a package-level SBOM. CRACI vs StepSecurity

Package and input security

Socket

Socket analyzes how open-source packages behave: install scripts, network and filesystem access, obfuscated code, known malware and typosquats. It flags risky additions in pull requests, and Socket Firewall blocks malicious packages at install time, with a free version for npm, yarn, pnpm, pip, uv and cargo. It also offers reachability analysis. Best for stopping bad packages before they land, including ones with no advisory yet. Watch out: it reads the manifest and lock files a project declares, and its firewall filters package installs, not the rest of a job's network traffic. CRACI vs Socket

Chainguard

Chainguard builds open-source software from source and ships it hardened: container images it calls zero-CVE, Java, Python and JavaScript libraries rebuilt from verified source, VM images and hardened GitHub Actions, each with a signed SBOM and SLSA provenance. For customers with an order it commits to remediating critical CVEs within 7 days and other severities within 14 days of a qualifying patch. Best for teams whose scanners keep flagging CVEs in base images. Watch out: its SBOMs and provenance describe Chainguard's artifacts. Your own build still needs its own record, which is why it pairs well with a build-level tool. CRACI and Chainguard

Binary analysis

ReversingLabs

ReversingLabs Spectra Assure analyzes finished software packages without source code, using static binary analysis, 16 malware detection engines and differential analysis that flags suspicious changes between versions. It exports CycloneDX and SPDX SBOMs from the binary and can assess commercial and third-party software before you deploy it. Best for a release gate against malware and tampering, and for software you did not build. Watch out: it works backward from the output, so it does not see build tools or test dependencies the build fetched but did not ship. CRACI vs ReversingLabs

Frameworks and regulations behind the category

Much of the demand for these tools comes from frameworks and rules that ask for an inventory of components, a record of how software was built, and a process for handling vulnerabilities.

• SLSA (Supply-chain Levels for Software Artifacts) is a set of incrementally adoptable guidelines, maintained as a cross-industry collaboration under the Linux Foundation. Its Build track grades how trustworthy a build's provenance is.
• NIST SSDF (SP 800-218, version 1.1, February 2022) sets out secure software development practices to reduce vulnerabilities in released software.
• US Executive Order 14028, Section 4(e), directed software supply chain guidance that includes giving a purchaser an SBOM for each product. It shapes federal procurement guidance rather than binding every vendor directly.
• CISA, NSA and ODNI published "Securing the Software Supply Chain: Recommended Practices Guide for Customers" in 2023, covering procurement, testing, deployment, patching and SBOMs.
• The EU Cyber Resilience Act (Regulation (EU) 2024/2847) puts its reporting obligations into effect on 11 September 2026 and applies in full from 11 December 2027.
• NIS2 Article 21(2) names supply chain security and vulnerability handling among the measures it requires, and the US FDA requires an SBOM from makers of cyber devices.

None of these frameworks names a product category. What they have in common is evidence: an accurate component list per release, a record of how it was built, and proof that vulnerabilities were tracked.

Where does CRACI fit?

CRACI is a runner for GitHub Actions. You change runs-on to craci, and while each job runs, a package-aware proxy records what it fetched, including packages restored from CI caches. Each SBOM carries a completeness state per job and per cache. An egress policy, default deny or default allow, is validated before the job starts and fails closed. CRACI keeps re-evaluating the SBOMs of what shipped. CRACI's inventory view shows exactly which software versions are deployed to which products, globally. The result is an SBOM per build, a record of what each build reached, and provenance data from the API, which automates a significant part of the supply chain visibility and evidence your CRA process needs.

CRACI is not the right choice if you need SAST, secrets or IaC scanning, posture checks across your repositories, an audit mode before blocking, package blocklists (on the roadmap), binary analysis, or CI systems other than GitHub Actions today (GitLab CI and Jenkins are on the roadmap). Many teams pair it with a tool above: an ASPM platform for code and posture, Socket or Chainguard for inputs, ReversingLabs for the output. Read more about build-time SBOM generation, CI/CD integration and pricing, or book a demo to see a recorded build end to end.

Compare tools for each part of the supply chain

This page is the overview. Each area has its own deeper comparison and guides.

• SBOMs: SBOM tools compared, build-time SBOM generation, why build-time SBOMs and how to generate an SBOM in GitHub Actions.
• Runners and CI/CD security: GitHub Actions runner providers, runner security tools, CI/CD pipeline security checklist and egress policy for GitHub Actions.
• Dependencies: SCA tools compared and transitive dependencies explained and what software composition analysis is.
• Regulation: CRA compliance tools.
• Why the build: why supply chain security belongs in CI and software supply chain security with CRACI, and why internal and low-risk software needs it too.

CRACI compared with each tool

• CRACI vs Apiiro Risk graph from code vs evidence from the build.
• CRACI vs Cycode ASPM plus a build agent vs the build runner itself.
• CRACI vs OX Security PBOM from connected tools vs a record from the runner.
• CRACI vs Legit Security Securing the SDLC vs recording the build.
• CRACI vs Kusari Supply chain graph vs build SBOMs with monitoring.
• CRACI vs ReversingLabs Binary analysis of the output vs evidence from the build.
• CRACI vs Socket Package behavior analysis vs build observation.
• CRACI vs Chainguard Secure inputs vs a secure, recorded build.
• CRACI vs Xygeni AppSec platform with build attestations vs being the build runner.
• CRACI vs Wiz Workflow posture findings vs enforcement inside the job.
• CRACI vs Safeguard Scanning and AI auto-fix vs recording the build itself.

Software supply chain security FAQ

Short answers to the questions buyers ask most

What are software supply chain security solutions?

Tools that protect everything that goes into your software between the first commit and the release: open-source dependencies, base images, build tools, CI pipelines and the artifacts you ship. The main types are ASPM platforms that map risk across the development lifecycle, software composition analysis for dependencies, build and runner security, package firewalls, hardened images, binary analysis, and SBOM and provenance tools.

What is the best software supply chain security platform?

There is no single best one, because each covers a different link. ASPM platforms such as Apiiro, Cycode, OX Security and Legit Security are strongest at breadth across repositories and CI systems. Endor Labs focuses on reachability for dependency findings, Socket on malicious packages, Chainguard on hardened inputs and ReversingLabs on finished binaries. CRACI is the choice when you need a record of what each GitHub Actions build actually pulled in, with egress control and provenance data.

How is software supply chain security different from application security?

Application security looks for flaws in the code your team writes, with tools such as SAST and DAST. Software supply chain security covers what surrounds that code: third-party components, the build system, the CI pipeline and the path from build to release. The xz utils backdoor, the tj-actions/changed-files compromise and the Shai-Hulud npm worm all came in through the supply chain, not through a bug in the victims' own code.

Which software supply chain security tool should I start with?

Start from the question you cannot answer today. If you do not know which vulnerable dependencies you ship, start with SCA. If malicious packages worry you most, look at a package firewall. If you have to prove what went into each release, for customers or for the EU Cyber Resilience Act, you need a record taken during the build. Large programs with many repositories and CI systems often add an ASPM platform on top.

Do I need an SBOM for software supply chain security?

Increasingly, yes. The EU Cyber Resilience Act asks manufacturers to identify the components in their products, including by drawing up an SBOM, and to handle their vulnerabilities. The US FDA requires an SBOM for cyber devices, and US Executive Order 14028 shaped federal guidance that asks suppliers for one. An SBOM is only as useful as it is complete, so ask every vendor where its component list comes from and whether it tells you when the list is incomplete.

How is CRACI different from a supply chain security scanner?

Scanners read files after the fact: a manifest, a lockfile, source code or a finished binary. CRACI is a recorder. It is the runner for your GitHub Actions jobs, and while each job runs it records the packages the job actually pulled in, including packages restored from CI caches. Each SBOM states its own completeness, an egress policy controls what the build can reach, and the API returns SBOMs, network traces and provenance.

Which CI systems does CRACI support?

GitHub Actions today; other CI systems are on the roadmap, GitLab CI and Jenkins among them. Runners are Linux on x86-64 and ARM64, with Windows and macOS on the roadmap. Most platforms on this page cover several CI systems, so weigh that if you also run Jenkins or Azure Pipelines.

What do software supply chain security tools cost?

Most charge per developer. As of September 2026, StepSecurity Enterprise is $16 per contributing developer per month and Socket Team is $25 per developer per month, while Cycode, OX Security and Endor Labs sell paid plans through sales. ReversingLabs Community+ is a flat $500 per month, Chainguard offers up to five images free, and CRACI charges only for build minutes, $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), with no monthly fee.