Per-CVE reachability: what changes when triage becomes automated?

TL;DR: Per-CVE reachability can cut vulnerability triage from package-level noise to symbol-level evidence by separating imported dependencies from actually called vulnerable functions, according to Nullify, so severity rollups stop treating every bundled CVE as equally reachable. The governance challenge is not classification alone but preserving auditable, confidence-bounded decisions that reduce headcount dependence without hiding real exposure.

Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “Per-CVE Reachability: Doing the Triage Without the Headcount”.

Key questions

Q: How should security teams prioritise CVEs inside bundled dependency findings?

A: Treat the bundle as a queueing mechanism, not a remediation decision.

Q: Why do package-level vulnerability scores often overstate real risk?

A: Because a package can contain many vulnerable symbols, and most applications use only a subset of them.

Q: What are the signs that alert automation is failing?

A: Common signs include endless repeat investigations, high analyst turnover, brittle playbooks that break when conditions change, and large numbers of alerts still reaching human review after automation is in place.

Practitioner guidance

• Instrument reachability before severity downgrades Require package import checks and symbol-level call analysis before any CVE can move below its scanner-assigned severity.
• Separate confidence thresholds from suppression rules Allow only high-confidence symbol evidence to justify large downgrades, and keep uncertain negatives from hiding reachable issues.
• Persist evidence with every triage decision Store the call sites, confidence level, and method for each CVE so reviewers can audit why a finding was reprioritised.

Bottom line: Dependency counts alone do not tell you which vulnerabilities matter, because bundled findings can include CVEs the application never reaches.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →