StepSecurity
Supply-chain security platform that locks down GitHub Actions CI/CD pipelines against malicious packages and compromised dependencies.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
StepSecurity sells a software supply-chain security platform built around Harden-Runner, a behavioral-monitoring agent for GitHub Actions runners that blocks unexpected network egress and anomalous process activity during CI/CD jobs. The platform extends across four control points: developer machines (governing AI coding agents and IDE extensions), code repositories (PR screening with auto-remediation), package registries (blocking compromised packages), and CI/CD pipelines themselves, plus a library of hardened drop-in replacements for risky third-party GitHub Actions.
What sets StepSecurity apart from generic SCA/SAST tooling is its focus on the CI/CD runtime layer itself rather than just source code: it watches what a pipeline actually does at execution time. That approach got independent validation in March 2025, when Harden-Runner’s anomaly detection was credited by multiple independent security outlets as the first signal that led to discovery of the tj-actions/changed-files GitHub Action compromise (CVE-2025-30066), an attack that affected roughly 23,000 organizations.
Innovation Matrix Assessment
Shipped Harden-Runner, Dev Machine Guard, Code Repo Security and Maintained Actions in succession, and has published threat-intel advisories on multiple live npm/GitHub Actions supply-chain attacks as they occurred.
Gives AppSec/platform teams visibility into CI/CD runtime behavior they otherwise lack, with documented adoption by named engineering orgs (Mercari, Miro, Dexcom, Coveo, Chainguard, Kong) per the vendor's own case studies.
Only a disclosed $3M seed round (May 2024, Runtime Ventures) and a small team (roughly 11-20 people per multiple directories); real but early-stage traction, not yet broad enterprise scale.
Runtime behavioral monitoring of CI/CD pipelines is a meaningful shift from static SCA/SAST scanning, but it remains a focused point solution within the broader software supply-chain security category rather than a category redefinition.
Independently corroborated: Unit42 (Palo Alto Networks), Wiz, Aqua Security and Infosecurity Magazine all describe Harden-Runner's detection as central to uncovering the real-world tj-actions/changed-files attack (CVE-2025-30066) in March 2025 — a verifiable, named incident, not a vendor-only claim.
CI/CD and build-pipeline compromise (npm worms, Action takeovers) is a growing, structural attack vector as software delivery accelerates, so runtime pipeline defense is likely to stay relevant for years.
Why CISOs Should Care
Gives security teams a way to catch supply-chain compromises inside the build pipeline itself — where tj-actions, Shai-Hulud and similar attacks actually executed — rather than relying solely on post-hoc code scanning.
What Makes It Different
Monitors CI/CD runner behavior (network calls, process execution) in real time instead of only scanning source code or dependency manifests, catching live compromise rather than just known-vulnerable packages.
The Matrix Verdict
67/100 — INCREMENTAL INNOVATOR
An Incremental Innovator: a well-executed, independently validated point solution for a real and growing attack surface (CI/CD supply chain), with genuine evidence of catching a live, named attack, but still seed-stage with limited scale and a narrow (if sharp) product focus.
Editorial Note: Claims vs. Verified Findings
The tj-actions/changed-files detection credit is independently corroborated by Palo Alto Networks' Unit42, Wiz and Aqua Security write-ups, not just StepSecurity's own blog. Customer-logo claims (Mercari, Dexcom, etc.) and specific headcount/founding-year (sources split between 2021 and 2022) come only from the vendor's site and directory aggregators and are unverified beyond that.
Sources
Alternatives to StepSecurity
Endor Labs
Reachability-based software composition analysis that filters open-source dependency risk down to what code paths are actually exploitable.
JFrog
Public software supply chain security platform (Xray plus Advanced Security) that scans binaries and artifacts end-to-end from the…
Apiiro
Builds a continuous 'code risk graph' that maps code, developers, and cloud deployment to prioritize AppSec findings by…
Socket
A software supply chain security platform that combines automated dependency analysis with human verification to catch malicious and…
ThreatLocker
CISO ReviewedZero Trust endpoint protection platform that blocks unknown applications by default through allowlisting, ringfencing, and storage control.
ArmorCode
Tool-agnostic ASPM layer that correlates findings from 300+ existing security tools into one prioritized backlog, without running its…