Overview
This section documents what AlertaVuln actually watches on your behalf. Everything in the matrix below is live today.
The web app ships full light and dark mode support across every page. Demo data.
The Enterprise Risk Matrix plots your open vulnerabilities by business impact against exploit likelihood, using CISA KEV and EPSS to rank the likelihood axis. Demo data.
Coverage matrix
Section titled “Coverage matrix”| Area | What it finds | How | Details |
|---|---|---|---|
| Dependencies (SCA) | Known CVEs affecting the packages you actually depend on, matched the moment they are announced | Tech stack derived from the manifests in your connected GitHub / Azure DevOps repos, enriched from NVD, GitHub Advisory, OSV and CISA KEV | Dependencies |
| Static code analysis (SAST) | Insecure code patterns in your source | Specialised code scanners, run locally by the CLI | av sast scan |
| Secrets | Committed credentials, tokens and keys | The scan series’ secret scanners, run locally | av sast scan |
| IaC misconfiguration | Misconfigured Terraform, Dockerfiles, Kubernetes manifests, Helm charts and similar | The infrastructure misconfiguration scanner | av sast scan |
| Licenses | Licence terms in the scanned tree, and each package’s registry licence metadata | A licence scanner over the tree (its own License finding category), plus registry metadata captured per package | av sast scan, Package health |
| Package health | Deprecated, unmaintained and stale packages, and newer versions available upstream | Public registry data across all eight supported ecosystems | Package health |
| Reachability | Whether each dependency CVE is actually exploitable in your project, so the alerts that matter rise to the top | Local usage analysis (av reach analyze) combined with EPSS, CISA KEV, attack vector and your declared exposure - Business and Enterprise |
Reachability |
| Test coverage leverage | Which functions a single new test would exercise the most of the application through - not a coverage percentage, and your tests are never run | A greedy set-cover over the same whole-program call graph the reachability gate builds | Test coverage leverage |
| AlertaVuln AI | Explaining and fixing findings with an assistant. Today this hands context to your own assistant and involves no model operated by us; the hosted service is not yet available | BYOAI handoff via the IDE or a copied prompt - see the page for what the hosted option would send, keep and audit | AlertaVuln AI |
One verdict system
Section titled “One verdict system”Dependency alerts and code-scan findings share the same three-tier triage: every finding is RED, YELLOW or GREEN, with the reasoning attached. See the introduction for how the tiers work.
In this section
Section titled “In this section”Dependencies (SCA)Eight ecosystems, event-driven CVE matching, best-source enrichment.
Package healthDeprecations, staleness, licences and updates available - straight from the registries.
ReachabilityScore each alert by whether the vulnerability is actually exploitable in your project - usage, exploit context, and exposure.