How Reachability Works
Reachability analysis combines static analysis of your application's call graph with vulnerability data to determine whether the code path that triggers a CVE is actually reachable in your specific application's usage of a library. A vulnerable function in a library only creates real risk if that function can actually be called — directly or indirectly — through your application's execution paths. If your application uses Log4j only for basic logging and never exercises the JNDI lookup feature, the Log4Shell vulnerability is technically present but functionally unreachable.
The Mathematics of Noise Reduction
Snyk's research, which helped popularize reachability analysis, found that in Java applications, approximately 75-80% of CVEs in dependencies are in code that is never reached by the application. For JavaScript/Node.js, reachability is more complex due to dynamic linking, but similar ratios have been reported. The practical implication: a scanner reporting 100 CVEs may have only 15-25 that represent genuine risk. Reachability analysis helps you focus on those 15-25.
Limitations of Reachability Analysis
Reachability analysis is powerful but not perfect. It is more reliable for statically-typed, compiled languages (Java, C#, Go) than for dynamically-typed languages (Python, JavaScript) where the call graph is harder to resolve statically. It is also inherently point-in-time — new code paths added in future development could make currently "unreachable" vulnerabilities suddenly reachable. Reachability should reduce alert fatigue, not eliminate security rigor. A low-severity vulnerability in reachable code may still require attention, while a critical CVE in technically unreachable code still warrants understanding why it is unreachable.
EPSS: A Complementary Prioritization Signal
The Exploit Prediction Scoring System (EPSS) complements reachability analysis at the vulnerability level. While reachability analyzes whether a vulnerability is reachable in your application, EPSS estimates the probability that a given CVE will be exploited in the wild within the next 30 days. Combining reachability (is it reachable in my code?) with EPSS (is it being actively exploited?) and CVSS (how severe?) gives security teams a three-factor prioritization framework that dramatically reduces noise while maintaining risk coverage.
Focus on Real Risk with Fossity's Vulnerability Prioritization
Fossity — Fossity combines CVSS severity, EPSS exploitation probability, and reachability analysis to surface the vulnerabilities that actually matter in your specific application — reducing security team workload while improving risk coverage.
Visit Fossity.com →