BinSkim Integration Guide

Integrate BinSkim with Vulnetix. Analyze compiled binaries for security issues. SARIF is the default output format.

Install & scan

$ dotnet tool install --global Microsoft.CodeAnalysis.BinSkim
$ binskim analyze myapp.exe --output binskim.sarif

Run BinSkim in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install BinSkim
  run: dotnet tool install --global Microsoft.CodeAnalysis.BinSkim
- name: Run BinSkim
  run: binskim analyze "build/**/*.dll" --output binskim.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: binskim
    path: binskim.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under BinSkim's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace BinSkim. Keep running it. Vulnetix sits on top of BinSkim (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

BinSkim is strongest at its core category and also carries features in Compilers, Linters & Code Quality, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What BinSkim does well

• Validates compiled-binary security posture (PE, ELF, and now Mach-O), a layer source SAST never sees: ASLR/DEP/high-entropy VA, stack protection (GS/stack canaries), CFG/Control Flow Guard, and code-signing
• Catches missing compiler/linker hardening flags on release builds, ideal as a final gate before shipping artifacts
• Native SARIF output for clean CI integration and interchange
• Maintained by Microsoft with a documented, extensible rule set for binary compliance policies

Where Vulnetix adds to it: BinSkim inspects compiled artifacts for hardening flags, a unique surface Vulnetix does not run itself; Vulnetix ingests its SARIF and consolidates it with source SAST, SCA and container findings into one deduplicated, exploit-intel-prioritised queue with VEX and policy, complementing BinSkim's binary-level checks.

No migration, no rip-and-replace. BinSkim keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise BinSkim results in Vulnetix

Upload BinSkim SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

BinSkim documentation ↗  ·  Source repository ↗

Wire BinSkim into your CI/CD pipeline →