As a Developer, I want SCA tool results integrated with reachability analysis and EPSS scoring, so that I can prioritize remediation efforts effectively.

[branic18]

Enhance the SCA platform combining reachability analysis with EPSS threat intelligence to accurately identify, prioritize, and reduce noise from false positives in vulnerability detection.

Priority: High

User Personas

• AppSec/Security Analyst

Acceptance Criteria

• Given a vulnerability scan, when it's complete, then the false positive rate is below 5%.
• Given a detected vulnerability, when EPSS data is refreshed, then the prioritization scores are recalculated accurately without rescanning code.
• Given dependency changes, when a package is added, removed, or upgraded, then only affected dependencies and vulnerability mappings are recalculated.

Subtasks

• Refine detection algorithms.
• Implement a verification process for reported vulnerabilities.
• Integrate EPSS threat intelligence scoring.
• Develop reachability analysis capabilities.

Ordered Steps

1. Run initial vulnerability scan.
2. Review and adjust thresholds for alerts.
3. Detect dependency changes and trigger partial updates.
4. Refresh EPSS scores independently and recalculate risk scores.

Definition of Done

False positives are minimized, prioritization is based on exploitability and business risk, and remediation efforts focus on reachable vulnerabilities likely to be exploited.

Referenced Insights

• 252e65fa-10b3-4cf6-a7f1-50391bd8ec76