Analysis & detection

What is Reachability Analysis?

Determining whether your code actually calls the vulnerable function inside a flagged dependency.

Most dependency CVEs are unreachable in practice: the package is installed, but the affected function is never invoked from your code. Reachability analysis builds a call graph to check, and typically cuts the actionable list by a large margin.

It is the single most effective noise-reduction feature in SCA, which is why it is usually gated behind higher plan tiers and limited to a handful of languages.

Top 10 Reachability Analysis tools

Every tool in the directory documented as supporting Reachability Analysis, 7 fully, 3 partially, with what its own documentation says.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

  1. 1
    CodacyQuality PlatformTeam

    Affected-functions analysis AI-checks whether vulnerable dependency code is actually used.

  2. 2
    Checkmarx OneCode Security Platform

    Exploitable Path reuses SAST to trace the call path to the vulnerable method; Python, Java, JavaScript, C# only.

  3. 3
    CodeRabbitPR Reviewadd-on

    Deep Scan findings carry reachability and exploitability signals with call stacks when available

  4. 4
    CorgeaCode Security Platform

    Checks import plus whether the vulnerable function is called; direct deps only

  5. 5
    DeepSourceQuality Platformadd-on

    Call-graph tracing to the vulnerable function; REACHABLE/UNREACHABLE/UNKNOWN with call-path visualisation.

  6. 6
    SemgrepCode Security Platform

    Five reachability states plus transitivity for 10 languages; Rust version-comparison only; Dart and Elixir unsupported.

  7. 7
    VeracodeCode Security Platformadd-on

    Vulnerable Methods scan (Level 3) checks whether first-party code calls vulnerable third-party methods

  8. 8
    AikidoCode Security PlatformPartialPro

    AI CVE exploitability analysis prioritizes exploitable over theoretical; no call-path reachability claimed

  9. 9
    GreptilePR ReviewPartial

    Repo graph surfaces impacted callers and contracts of changed code; not dependency-vulnerability reachability

  10. 10
    SnykCode Security PlatformPartial

    Java and JavaScript only; Early Access via Snyk Preview; limits of 300,000 files / 3GB.

What to look for

  • Which languages support it, since coverage is usually narrow
  • Whether reachability covers transitive dependencies or only direct ones
  • Whether unreachable findings are suppressed, or just ranked lower
  • Whether the call path is shown so you can verify the conclusion

Related terms

SASTTaint / Data-Flow AnalysisSecrets DetectionSecrets ValidationSCA (Software Composition Analysis)Malicious Package Detection

FAQ

What is Reachability Analysis?

Determining whether your code actually calls the vulnerable function inside a flagged dependency.

How many tools support Reachability Analysis?

10 of the 20 tools tracked in this directory support Reachability Analysis, 7 fully and 3 partially, including Codacy, Checkmarx One, CodeRabbit, Corgea, DeepSource. Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

What should you look for in Reachability Analysis?

Which languages support it, since coverage is usually narrow. Whether reachability covers transitive dependencies or only direct ones. Whether unreachable findings are suppressed, or just ranked lower. Whether the call path is shown so you can verify the conclusion.