Why does my CVE scanner flood me with alerts for code paths my app never runs?

Software composition analysis tools scan every package in the dependency tree and report every known CVE, but they rarely trace whether the application ever calls the vulnerable function. Industry data and 2025 research show roughly 95% of transitive dependency alerts are unreachable from real code paths. No tool today does accurate call-graph reachability at CI speed across polyglot stacks with mixed build systems. Teams respond by disabling alerts or triaging hundreds of findings that never matter, while the small fraction of genuinely exploitable vulnerabilities gets buried. The result is alert fatigue that erodes trust in security tooling, or unfixed vulnerabilities that slip into production unnoticed.