01
Scan
Detect CVEs.
Standard CVE detection across your dependency tree. npm, pip, maven, gems, Go modules, cargo.
Product
Software Composition Analysis
Traditional SCA flags every CVE in your dependency tree. We pinpoint each advisory's vulnerable function and trace execution paths to find the ones that are actually reachable at runtime: the CVEs the whitebox pentest then tries to exploit.
A typical SCA scan flags hundreds of CVEs. Most point at code that never runs. A research agent pinpoints each vulnerable function. The Code Property Graph checks whether your code calls it. Execution tracing confirms whether the call path is ever reached. The reachable ones become exploit targets for the whitebox pentest; the rest is noise.
What traditional SCA misses.
Legacy SCA stops at vulnerability identification: it matches lockfile versions against advisories and reports what is present. It never validates whether the vulnerable code can execute. Three checks get skipped.
Miss 01
Which specific function or framework is vulnerable.
An advisory typically flags a specific method signature, not the whole package. The actually-vulnerable surface is a small subset of what ships in the library.
Pinpoint the function.
Miss 02
Whether your codebase actually uses that function.
Many libraries ship with APIs you never touch. A package can carry a critical CVE in a module your code never imports, and a lockfile scan cannot tell the difference between a real call site and an unused export.
Check the call sites.
Miss 03
Whether that function is ever actually reached in your code.
Even if you call it, dead code, conditional compilation, and test-only paths often keep it from ever running in production. Reachability requires walking the path from a live entry point, not just confirming a syntactic reference.
Walk the path.
The combined effect
Together they eliminate 70-90% of the noise from a traditional scan.
Those three checks collapse the long tail of lockfile CVEs into a short list your team can actually fix.
See how reachability works ↓How reachability works.
Five stages, from dependency scan to prioritized verdict. Static CVE lists in, proven executable paths out.
02
Research
Read the advisory.
A research agent reads each advisory and extracts the exact vulnerable function or method signature, not just the package version.
03
CPG Lookup
Check call sites.
The Keygraph platform queries the Code Property Graph to check whether your code imports and calls the specific vulnerable function.
04
Trace
Walk the path.
We walk forward from application entry points to confirm whether the vulnerable code is actually reachable at runtime.
05
Classify
Rank the risk.
Proven Executable, Likely Reachable, or Not Reachable. Reachable findings queue up as exploit targets for the whitebox pentest; triage by impact, not lockfile presence.
Reachability analysis: two modes.
A CVE in your lockfile is a hypothesis, not a finding. Reachability analysis validates whether the vulnerable code can actually execute in your application, and that evidence determines which dependencies warrant remediation.
Mode 01 · Function-Level
Method Usage Analysis.
For function-level vulnerabilities. The Keygraph platform runs data-flow analysis to trace execution paths from your code into the vulnerable dependency function. The report records total paths analyzed, confirmed reachable paths, and unvalidated paths, and each finding cites its sink locations (file, line, code snippet) so reviewers can verify the result themselves.
Mode 02 · Library-Level
Library & Framework Analysis.
For library and framework vulnerabilities where code-level data flow isn't applicable. Analyzes how the vulnerable package is imported and used across the codebase. Distinguishes production usage from test-only usage, and evaluates exposure conditions and mitigating factors.
Combined Risk Score
CVE severity adjusted for reachability.
NOT_REACHABLE downgrades risk to Low regardless of CVE severity. CONFIRMED_REACHABLE plus a High CVE elevates to Critical. POTENTIALLY_EXPOSED plus a Medium caps at Medium. Developers see the risk that matters, not just the CVE score. This reachability-adjusted verdict lets teams prioritize by real risk, and gives your supply chain program evidence grounded in your code, not a raw advisory feed.
See it eliminate the noise.
Schedule a demo and watch reachability-aware SCA run against your dependency tree.