Phoenix Security is proud to unveil its latest headline feature, Runtime Reachability Analysis and Contextual Deduplication, which sets a new standard in Application Security Posture Management (ASPM). These features offer a powerful way for security teams to correlate vulnerabilities from code to runtime, significantly reducing noise and enabling smarter, more focused vulnerability prioritization.
For more research and details on the reachability analysis
- How EPSS and Reachability Analysis Work Together in ASPM for Optimized Vulnerability Management
- The Ultimate Guide to Reachability Analysis Which reachability is good for you: Enhancing Code, Library, and Container Security with ASPM
- Understanding Reachability Analysis in Application Security and ASPM: Methods, Impact, and Real-World Applications a webinar with James Berthoty
- Release Date: 25 November 2024
- Version 3.35
What is Contextual Runtime Reachability analysis, and what are the benefits for you?
With Phoenix Security’s advanced reachability analysis, users can filter out irrelevant vulnerabilities by focusing on what is exploitable in both code and running containers. By leveraging contextual deduplication, Phoenix helps security teams declutter their vulnerability landscape, reducing runtime noise by up to 90% and with full vulnerability deduplication across code and cloud environments by 95%. These innovations ensure that your team only focuses on the vulnerabilities that truly matter—those in use and exploitable.
How does this ASPM feature help reduce vulnerabilities by 90%
Security teams today face an overwhelming amount of vulnerability data, much of which is not directly relevant to their actual risk exposure. Phoenix Security addresses this challenge by focusing on reachability analysis—the ability to determine whether a vulnerability is actually exploitable in a given environment.
Phoenix goes beyond basic vulnerability scanning by introducing two critical layers of analysis:
- Static Reachability Analysis: This determines whether vulnerable libraries are loaded in the code, when they are not actually in use (require access to build file and code repo) SBOM management.
- Runtime Reachability Analysis: Assesses whether applications running in containers or other environments are actively using these vulnerable libraries, ensuring vulnerabilities are prioritized based on real risk exposure.
- Container Version Trottling and Running traceability: Deduplicate contextually and pair up this feature with contextual deduplication at runtime
In tandem with contextual deduplication, Phoenix ensures that vulnerabilities are deduplicated across both the codebase and the runtime environment, providing clear insights into which vulnerabilities truly matter. This approach eliminates unnecessary noise, drastically improving prioritization efforts.
Contextual risk-based approach with Reachability analysis in ASPM
Phoenix Security’s 4-Dimensional Risk Quantification for Application Security Posture Management (ASPM) goes beyond traditional CVSS or EPSS-based metrics, providing a more comprehensive, contextualized view of vulnerabilities. By integrating Business Criticality, Network Reachability (determining if the container is accessible externally), Static Reachability (checking whether libraries are loaded in the code), and Contextual Reachability (confirming if libraries are active in running containers), organizations gain a clearer understanding of real-world exposure. Combined with advanced threat intelligence and deduplication, Phoenix ensures vulnerabilities are prioritized based on true risk, reducing noise and enabling more effective risk-based remediation.
The Runtime Reachability Analysis highlighted Phoenix’s contextual Exposure, Asset Externability factor, and Impact Factor.
What is reachability analysis, and how does Phoenix Security help
Reachability analysis is a method used to determine whether a vulnerability in code or a library is actually exploitable in a given environment. It helps security teams prioritize vulnerabilities by analyzing whether vulnerable code is actively used in the codebase or deployed applications. By identifying which vulnerabilities are “reachable” and can potentially be exploited, reachability analysis provides a more focused and effective way to address real-world risks. It reduces the noise from non-critical issues and enables smarter vulnerability management across code, containers, and runtime environments.
Key Features
Code-to-Runtime Vulnerability Correlation in Phoenix ASPM
• Phoenix Security’s reachability analysis allows for a direct correlation between runtime vulnerabilities and the underlying code. This ensures that security teams can link vulnerabilities identified in the code to those actively impacting their running applications, leading to better prioritization and remediation strategies.
• Real-time insights into which vulnerabilities are actively used or reachable in running environments, allowing for highly focused remediation efforts.
AI-Based ASPM for Prioritization through Reachability and Runtime Deduplication
• Contextual Deduplication intelligently removes duplicate vulnerabilities from the security stack, ensuring that vulnerabilities are not counted multiple times across code, containers, and cloud environments.
• By combining reachability analysis with runtime deduplication, Phoenix further filters out vulnerabilities that do not pose a true risk, allowing security teams to focus on what is exploitable and needs immediate action.
Upcoming Link Code to cloud
with AI Runtime Reachability Analysis we were able to discover and correlate which repository’s build file and artefact are built-in containers and leveraging those insights we were also able to create a correlation of code 2 cloud. In Q1 2025 we are looking to also add automatic deployment suggestion and expansion of the link between an application and the containers where this application is deployed
Reachability Analysis for Smarter Risk Management
• Static Reachability Analysis identifies vulnerable libraries included in the code but not necessarily used.
• Runtime Reachability Analysis refines this by focusing on vulnerabilities actively used in the deployed environment, such as those being exploited in running containers or applications. This multi-layered approach allows for much more precise vulnerability prioritization.
Why Prioritization through Reachability Matters
The sheer volume of vulnerabilities detected in modern applications often overwhelms security teams, leading to delays in remediation and inefficient resource use. With Phoenix Security, teams can leverage reachability analysis to filter vulnerabilities by those that are actually exploitable in a specific environment, helping to reduce risk with more targeted actions.
While traditional methods rely on broad CVSS scores or EPSS to gauge risk, reachability analysis adds critical context—Is this vulnerability being used in my environment? By focusing on actual usage, Phoenix ensures that vulnerabilities are prioritized based on their impact in the real world, not just theoretical exposure.
Contextual Deduplication: Cleaning Up the Noise
In addition to reachability analysis, Phoenix Security’s contextual deduplication removes duplicate vulnerabilities across the entire pipeline, from code to running containers, ensuring that security teams don’t waste time on irrelevant vulnerabilities. This is particularly effective when applied to cloud and container environments, where duplicates can often clutter the vulnerability landscape.
An example of this effect is when building several versions of the container images and having indication of where those vulnerabilities need to be fixed :
By leveraging both contextual deduplication and runtime deduplication, Phoenix Security enables security teams to focus their efforts on vulnerabilities that are both real and immediately exploitable in their environment. This reduces overall vulnerability noise by up to 90% in runtime environments, and with full deduplication, by 95%.
Container Version Throttling
Container Image Version Control:
Maintain clean and efficient control over different versions of your container images. Ensure that each deployed image is the most secure, stable, and optimized version while avoiding unnecessary deployment of outdated or vulnerable containers. The throttling system ensures that only authorized versions of your container images are deployed, keeping your infrastructure lean and secure.
Traceable Container Deployments:
Gain full traceability of deployed containers with precise tracking of when, where, and how often an image has been deployed. This allows you to verify which specific container image is currently running in your environment, offering a complete history of its deployment across your infrastructure. This visibility ensures better governance and compliance, whether you’re managing microservices, CI/CD pipelines, or large-scale production environments.
By leveraging container throttling and image version tracing, Phoenix Security enables security teams to focus on real and immediately exploitable vulnerabilities in their environment. This reduces overall vulnerability noise by up to 91% in runtime environments. The contextual deduplication, together with the image version runtime monitoring, enables Phoenix clients to reduce 50-80% the number of vulnerabilities in Static and SCA analysis and up to 91% for container running.
Real-World Risk-Based Prioritization with Phoenix Security
Phoenix Security’s risk-based vulnerability management approach combines the best reachability analysis, runtime deduplication, and contextual insights to empower security teams with a complete picture of their threat landscape. By correlating vulnerabilities from code to runtime, Phoenix ensures that only the vulnerabilities that matter are prioritized, allowing teams to remediate more effectively and reduce risk faster.
Why Choose Phoenix Security for Reachability and Contextual Deduplication?
Phoenix Security delivers a comprehensive, unified platform for simplifying vulnerability management across code, containers, and cloud environments. With reachability analysis and contextual deduplication, Phoenix allows teams to focus on the real-world threats that impact their specific environments, making vulnerability management faster, more accurate, and more effective.
• Up to 90% noise reduction in container runtime environments through reachability analysis.
• 95% vulnerability reduction through contextual and runtime deduplication.
• Direct code-to-runtime correlation to prioritize actively exploitable vulnerabilities in your environment.
With Phoenix Security, you can rest assured that your ASPM strategy is not just about finding vulnerabilities—it’s about finding the ones that matter.
Need assistance with reachability analysis or contextual deduplication? Contact our support team at support@phoenix.security.
Minimize the vulnerability risk and act on the vulnerabilities that matter most, combining ASPM, EPSS, and reachability analysis.
Organizations often face an overwhelming volume of security alerts, including false positives and duplicate vulnerabilities, which can distract from real threats. Traditional tools may overwhelm engineers with lengthy, misaligned lists that fail to reflect business objectives or the risk tolerance of product owners.
Phoenix Security offers a transformative solution through its Actionable Application Security Posture Management (ASPM), powered by AI-based Contextual Quantitative analysis. This innovative approach correlates runtime data, combines it with EPSS and other threat intelligence, and applies the right risk to code and cloud, delivering a prioritized list of vulnerabilities.
Why do people talk about Phoenix Security ASPM?
• Automated Triage: Phoenix streamlines the triage process using a customizable 4D risk formula, ensuring critical vulnerabilities are addressed promptly by the right teams.
• Actionable Threat Intelligence: Phoenix provides real-time insights into vulnerabilities’ exploitability, leveraging EPS and combining runtime threat intelligence with application security data for precise risk mitigation.
• Contextual Deduplication with reachability analysis: Utilizing canary token-based traceability for network reachability and static and dynamic runtime reachability, Phoenix accurately deduplicates and tracks vulnerabilities within application code and deployment environments, allowing teams to concentrate on genuine threats.
By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains current and focuses on the key vulnerabilities.
