Kusari Platform Reachability

See which vulnerabilities actually reach your code.

Find what's callable and rank what's exploitable across every direct and transitive dependency you ship, many layers below the one you chose.

Book a live demo
YOUR CODE DIRECT TRANSITIVE VULNERABLE FN your_app lib-a core-x parse() lib-b core-y decode() lib-c core-z render() VEX · NOT AFFECTED VEX · NOT AFFECTED REACHABLE
Commercial and Open Source Partners
Google Microsoft Intel Red Hat VMware Yahoo DTCC Guidewire Roche Clear Alpha Purdue University
"
Kusari is best-in-class for code security, transitive risk, and reachability, supplying the richest data set I have seen in this space.
Security leader · 11,000-seat energy tech company
What you get

Noise reduction you can defend.

Cut the queue to what's actually callable
  • Traces exploitability across direct and transitive dependencies
  • Creates a VEX statement for each unreachable finding
  • Runs against a graph built from your source for better accuracy
Rank with a process you can defend
  • Published methodology you can show an auditor
  • Replaces raw CVSS with a context-aware score
  • Factors in effort to fix, giving you faster remediation
Know what's actually in your software
  • Finds dependencies across repos, images, and pipelines
  • Ingests SBOMs and VEX from your builds and your suppliers
  • Updates on every build and advisory, so the picture is accurate when you need it
How it works

Ingest, graph, analyze.

Stage 01 · Ingest
Take in what you already have
  • Source and build artifactsModel the software from the build itself, where the deep layers are still visible.
  • SBOM and VEXTake documents from your own builds and from your suppliers, in CycloneDX or SPDX.
  • Existing scanner outputNormalize what your current tools report rather than replacing them.
Stage 02 · Graph
Assemble the full dependency tree
  • Transitive depthReach the layers where most exposure sits, below the dependency a developer chose.
  • Provenance and lineageKeep the record of where each component came from and how it got there.
  • Continuously updatedRefresh on every commit, merge, and new advisory.
Stage 03 · Analyze
Test what is callable, then rank it
  • ReachabilityTrace exploitability to the vulnerable code rather than the package version.
  • VEX with reasoningDocument the unreachable findings instead of quietly dropping them.
  • Kusari ScoreRank on severity, spread, and effort to fix, on an open methodology.

Reachability against a verified picture answers a question about your software. Against an inferred one, the answer is a guess.

Take a tour

See it on your own code

Bring a CVE you care about and a repository. We will show you what reaches you and what does not.

FAQ

Reachability, answered.

What does reachability actually mean?

Rather than asking whether a vulnerable package is present, reachability asks whether the vulnerable code is callable in your application. Kusari analyzes that across direct and transitive dependencies and writes the reasoning down as a VEX statement.

How much noise does it remove?

One regulated insurtech with a full SAST, SCA, and container stack already in place cut vulnerability noise by 90% after adding Kusari. The exact figure depends on your estate, and the reasoning behind every filtered finding stays available.

Doesn't every tool claim reachability now?

Most do. The difference is what the analysis runs against. Tools that start from a finished artifact have to infer its contents, because the build discards that information. Kusari runs reachability against a graph built from your source.

Do we have to replace our existing scanners?

No. Kusari runs above the stack you already have, ingests its findings, and adds the context those tools cannot produce on their own. The insurtech in our case study kept every existing tool in place.

How deep does the analysis go?

Kusari follows the tree well past the direct dependencies — many layers down, across repos, container images, and pipelines. That depth is the point: most exposure sits below the dependency a developer actually chose, which is where manifest-based tools stop.

Get started

Stop triaging what can't reach you.

Book a live demo