Why does my CVE scanner flood me with alerts for code paths my app never runs?
機会
Software composition analysis tools scan every package in the dependency tree and report every known CVE, but they rarely trace whether the application ever calls the vulnerable function. Industry data and 2025 research show roughly 95% of transitive dependency alerts are unreachable from real code paths. No tool today does accurate call-graph reachability at CI speed across polyglot stacks with mixed build systems. Teams respond by disabling alerts or triaging hundreds of findings that never matter, while the small fraction of genuinely exploitable vulnerabilities gets buried. The result is alert fatigue that erodes trust in security tooling, or unfixed vulnerabilities that slip into production unnoticed.
重要な理由
Reachability-aware SCA is the difference between a usable security signal and an alert machine that developers are trained to ignore.
機会をどう評価するか
Opportunity Scoreは測定値ではなく、私自身の見解です。どれほど痛みを伴うか、どれほど頻繁に影響を与えるか、そして今日時点で解決策がいかに少ないか。スコアが高いほど、構築する価値が高いと私は考えています。
それが現れたときにどれほどの痛みをもたらすか。
実際にどれほど頻繁に人々がそれに直面するか。
今日時点で、それに対する優れたツールがいかに少ないか。