###### Use Case

# Software Supply Chain Security

Full-stack visibility, minus the noise. Protect your software supply chain with reachability analysis that cuts alert volume by 90%.

Additional information provided by the ZeroPath AI about an RCE it found, stemming from a bad package version.

## The Challenge

[Sonatype's ten-year retrospective shows supply-chain attacks doubling again in 2024](https://investor.synopsys.com/news/news-details/2024/New-Synopsys-Report-Finds-74-of-Codebases-Contained-High-Risk-Open-Source-Vulnerabilities-Surging-54-Since-Last-Year/default.aspx). Conventional Software Composition Analysis tools generate mountains of unreachable CVE alerts, overwhelming security teams and delaying critical upgrades.

## Common Pain Points & How ZeroPath Solves Them

| Pain Point | How ZeroPath Solves It |
| --- | --- |
| **Alert overload**<br>Thousands of CVEs, most never executed | **Reachability analysis**<br>Only flags libraries actually invoked by your code |
| **Unmaintained dependencies**<br>74% of projects use abandoned packages | **End-of-life detection**<br>Identifies packages without active maintainers |
| **License compliance risk**<br>Manual tracking of OSS licenses | **Built-in compliance**<br>Automated license scanning with CycloneDX SBOMs |
| **Cross-tool blind spots**<br>Secrets in dependencies go undetected | **Unified analysis**<br>Correlates secrets, IaC misconfigs, and vulnerable deps |

## How it Works

### 1\. Discover

Map your entire dependency tree including transitive dependencies

### 2\. Analyze

Call-graph analysis identifies which code paths are actually reachable

### 3\. Prioritize

Focus only on exploitable vulnerabilities in your execution paths

### 4\. Remediate

AI-suggested upgrades that won't break your application

## Key Capabilities

### Reachability-First Analysis

- **Call-graph walking** to trace actual code execution
- **90% alert reduction** compared to traditional SCA
- **Function-level precision** for vulnerability assessment
- **Cross-language support** for polyglot applications

### Supply Chain Intelligence

- **End-of-life detection** for abandoned packages
- **Maintainer analysis** to assess project health
- **Update velocity tracking** for security responsiveness
- **Fork detection** to identify unofficial versions

### Compliance & Governance

- **License compatibility** checking across dependencies
- **CycloneDX SBOM** generation with one click
- **Export to VEX** for vulnerability exchange
- **Policy enforcement** for approved package lists

### Unified Risk View

- **Secrets in dependencies** detection and correlation
- **IaC misconfigurations** that amplify supply chain risk
- **Attack path modeling** from vulnerable dep to exploit
- **Business impact scoring** based on data sensitivity

## Detect & fix  what others miss