Does reachability matter

A while ago, I wrote an article called “5 types of reachability analysis” with Endor Labs. In that article, I talked about the 5 types of reachability, which I summarized as: Function-level reachability Package baselining Internet reachability Dependency-level reachability Package used in image At the heart of these types of reachability analysis is a simple goal: determining the likelihood that you’re actually vulnerable to something. Function level reachability says, “hey, you’re calling the function from the CVE, there’s a pretty high chance you’re vulnerable.” Package baselining says, “you’re calling this vulnerable function at the runtime.” Internet reachability says, “this function (or package) is accessible via the API.” Dependency level reachability let’s you know that the package containing the vulnerability is imported. Package used in image tells you that the package is indeed installed (yes this offers the least value!) In this article, I’ll address why reachability has bec

A while ago, I wrote an article called “5 types of reachability analysis” with Endor Labs. In that article, I talked about the 5 types of reachability, which I summarized as: Function-level reachability Package baselining Internet reachability Dependency-level reachability Package used in image At the heart of these types of reachability analysis is a simple goal: determining the likelihood that you’re actually vulnerable to something. Function level reachability says, “hey, you’re calling the function from the CVE, there’s a pretty high chance you’re vulnerable.” Package baselining says, “you