k9 Security Reachable Risk

Most of your dependency alerts cannot reach your code, and the few that can are buried among them. k9 Security Reachable Risk scores every Dependabot, Trivy, or other scanner alert by risk, so engineers work the queue in the right order: fix today, schedule, or defer with the reason written down.

Your agent analyzes reachability in your code. k9 scores each alert on three factors: Threat (VulnCheck KEV, CISA KEV, and FIRST EPSS exploitation evidence), Exposure (whether untrusted input reaches the vulnerable code), and Impact (how critical the asset is, from the risk context you declare). Each alert gets FIX_TODAY, REVIEW, SCHEDULE, or DEFER with the evidence behind it, so a deferral holds up when security or an auditor asks. CVSS severity is recorded, never used as a triage input.

See a real report: https://www.k9security.io/lp/reachable-risk/samples/

What you can do in Claude:

• Check whether a CVE is known exploited (VulnCheck KEV, a superset of CISA KEV) and how likely exploitation is (EPSS).
• Resolve GHSA and other advisory IDs to CVEs and read the advisory details.
• Score a dependency alert in the context where its code runs, and get a verdict with residual risk on the NIST SP 800-30 scale.
• Learn how to describe your deployment in a `.k9security/risk-context.yaml` file so verdicts reflect your environment.

Then fix them. In Claude Code or another coding agent with your repository open, k9's fix workflow has the agent upgrade each dependency worth fixing, run your tests, and open a pull request. Nothing merges without you. To triage weekly, use our GitHub Action or a Claude Code routine: https://docs.k9security.io/agents/

Pricing: 7-day free trial, no card required. Then $10/month for 1,000 alerts, $0.03 per alert above plan. One alert scored in every context where it executes is metered once. Lookups (KEV, EPSS, advisories) are not metered.

Get started: https://www.k9security.io/lp/reachable-risk-9/