thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Reachability Analysis

Determining whether vulnerable code in a dependency is actually called by the application, to prioritize SCA findings.

Definition

SCA tools often report hundreds of vulnerable components; reachability uses call graphs to identify which vulnerable functions are invoked. Combined with EPSS, KEV and VEX, it helps reduce noise.

Example

SCA lowers the priority of a CVE because the vulnerable XML function is never called by the app.

Exam tip

Reachability and VEX reduce SCA noise.

Related terms