When to run it
An SCA dashboard (Snyk, Dependabot, Mend, Black Duck or similar) with a backlog so large that teams have stopped looking at it.
Thousands of CVEs.Fix the ones that are reachable.
Clearing a dependency CVE backlog
The playbook in one paragraph
Your SCA tool reports thousands of vulnerable dependencies and the number never goes down. Ana works out which are actually reachable, upgrades them safely with tests, and documents why the rest can wait.
Works with
- SCA and SBOM sources - Ana connects to 30+ security tools
- Repositories and lockfiles
- CI pipelines
- Container registries
What Ana needs from you
- Which repos and images are in scope
- Upgrade policy: patch and minor automatically, majors reviewed
- Exceptions and frozen dependencies
How Ana runs it
Step by step.
5 steps from trigger to done - each one visible to your team as it happens.
- 01
Merge and de-duplicate
Ana pulls findings from every connected scanner and the SBOM, and collapses duplicates so one vulnerable library appears once, with every place it is used.
- 02
Rank by reachability
Ana checks whether the vulnerable function is actually called from your code and whether the service is exposed, then ranks by real exposure rather than CVSS alone.
- 03
Upgrade safely
Ana picks the smallest version that fixes the CVE, resolves conflicts in the dependency tree, applies required code changes for breaking APIs, and runs the tests.
- 04
Document what waits
Unreachable findings get a written rationale - not called, not exposed, or compensating control - so deferral is a decision, not neglect.
- 05
Keep it down
Ana watches for new advisories and opens the next upgrade PR as soon as a reachable one appears.
Who approves what
Approval gates
- Patch and minor upgrades
- Owning team review
- Major upgrades
- Owning team plus tech lead
- Deferral of a reachable finding
- Security lead
What you get
Deliverables
- 01Upgrade PRs with green CI
- 02A reachability-ranked vulnerability list
- 03Written rationale for every deferred finding
- 04An updated SBOM
What usually goes wrong
And how Ana handles it.
Risk
Upgrades that break the build
Ana resolves the whole tree and runs tests before opening a PR; failing upgrades come back with a diagnosis, not a red build.
Risk
Noise from transitive dependencies
Ana identifies the direct dependency to change so fixes land at the right level.
FAQ
Common questions.
Dependabot opens version-bump PRs. Ana adds reachability analysis, fixes the code that breaks, and documents what it leaves alone.
Keep going
Related playbooks.
Security
Turning a pentest report into merged fixes
A penetration test lands as a PDF with dozens of findings. Ana parses it, confirms which findings are reachable in your code and cloud, writes the fixes with regression tests, and hands the auditor evidence for every closure.
Read the playbook →Security
Fixing cloud misconfigurations at the source
Your CSPM tool flags public buckets, wide IAM policies and open security groups. Ana traces each one back to the infrastructure-as-code that created it, fixes it there, and stops it from coming back.
Read the playbook →Software
Upgrading a framework across dozens of services
A major framework or runtime version is going end-of-life and it touches every service. Ana plans the migration, upgrades each service in its own branch, fixes what breaks, and hands your team small, tested pull requests instead of one terrifying diff.
Read the playbook →See it in your stack
Run this playbook on your systems.
Thirty minutes, your repositories and cloud, one real instance of this job.