Security in 60 Seconds: Reachability Analysis for Dependabot
Carlin Cherry presents a short explanation of how reachability analysis adds application-specific context to Dependabot vulnerability alerts.
Using reachability to prioritize vulnerabilities
A vulnerable dependency does not, by itself, establish whether an application can call the affected code. Reachability analysis follows the call path to determine whether the application can invoke that vulnerable code.
The video positions reachability as one prioritization signal, not a standalone basis for deciding what to fix. Teams should consider it alongside:
- Severity of the vulnerability.
- EPSS, another signal for vulnerability prioritization.
- Production context, including how the application is used in production.