Prioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis

on YouTube ↗23m

" summary

Demonstrates using static reachability analysis and call graphs to cut noise from SCA alerts: manifests list transitive libraries but code-level reachability drops a Cargo example from 17 declared deps to a median of 6 actually used, and a scanner can reduce ~400–500 CVE hits to roughly 70–80 actionable ones. Compares manifest vs code usage, measures test coverage across ~500 GitHub projects (median ~60% coverage of direct-dependency functions), and surfaces phantom dependencies like pip installs embedded in source.

AI-written summary · about

" chapters (9)

1. 0:00Introduction to talk
2. 1:06SCA findings problem
3. 3:58Traditional dependency analysis limits
4. 6:26Static reachability analysis
5. 9:38Research comparison findings
6. 13:51Why static analysis matters
7. 16:39Remediation with static analysis
8. 20:11Key benefits summary
9. 21:53Q&A session

" related talks

• 54mOvercoming The Inundation Of Noisy Security AlertsAdam Berman · Global AppSec Dublin 2023
• 22mWhen is a vulnerability not a vulnerability? Overcoming the...Adam Berman · BSidesSF 2023
• 56mNarrow – SCA Reachability Analysis Without The EffortJosiah Bruner · Global AppSec Dublin 2023
• 33mWhat Good Is SCA If You Depend on 666 Packages?Katarzyna Brzozowska · Oh My Hack 2025
• 38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability AnalysisAharon Abadi, Ph.D · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 44mUsing Static Analysis Tools to Become A Superhero ProgrammerJamie Coleman · JCON EUROPE 2024
• 30mWhy We Need to Adopt Static Analysis in Dependency ToolsJoseph Hejderup · Conf42 DevSecOps 2022
• 16mContext Matters: Qualitative Insights into Developers' Approaches and...Elizabeth Lin, Dominik Wermke, William Enck, Sparsha Gowda · USENIX Security '25