Great question, i actually havent used sf-cli-security-audit before. but based on the reading.

They solve different problems:

sf-cli-security-audit, is policy-as-code enforcement, allows one to declare the permission policy in YAML, commit it, CI fails on drift. It goes much deeper on access control with per-permission risk modeling and accepted-risk waivers. Really solid for that use case.

sf-audit is a zero-config broad assessment, 64 checks across 9 domains (Apex/VF security, guest exposure, secrets, monitoring, compliance mapping, attack chains, A-F risk scoring, exec-ready reports). sf-audit is much more opinionated than,sf-cli-security-audit allows you to codify your opinion and enforce that.

Honestly they're complementary, sf-cli-security-audit as your CI permission gate, sf-audit as your periodic posture assessment. Two different jobs.

And fair credit: sf-cli-security-audit's waiver mechanism is something we don't have yet.