Understanding CVE Exposure: Runtime Monitoring vs. Static Reachability Analysis

Overview

Contrast CVE Shield reports on code that actually runs, not everything in your dependency tree, because what runs is what's actually exposed.

Key Concepts

1. Reachable vs. Reached

A vulnerable library is “reachable” if it exists anywhere in your codebase or dependency tree. It's “reached” only once its vulnerable code path actually executes. CVE Shield reports on reached, not reachable.

2. Why Not Just Use Static Reachability Analysis

Static tools estimate reachability using heuristics instead of observed execution. This approach has real coverage gaps of its own:

• They typically can't see into app server or platform libraries.
• They can miss dynamically loaded libraries.
• They can misclassify test-only libraries as production risk.
• Heuristic estimation means results can both over-report and under-report exposure.

3. Why Continuous Runtime Monitoring Works

Because runtime monitoring has no significant performance impact, it can run continuously in production. This means coverage isn't a one-time scan, it accumulates automatically as your application handles real traffic.

Expected Outcome

You understand why a CVE showing up in a dependency scan may not appear in CVE Shield, and why that's a feature of accuracy rather than a detection gap.

Related Resources

• What Is CVE Shield?
• Understanding Capacity Limits
• What Is CVE Monitoring vs. Blocking?
• What's the Difference Between CVE Shield and a Static Scanner?

Escalation path

• Free Tier: Post your question in the Community Forum