{
  "id": 8186080,
  "title": "Why Most \"Critical\" Vulnerabilities Never Get Exploited: Closing the Static-to-Runtime Context Gap",
  "url": "https://urgent.news/2026/09/18/why-most-critical-vulnerabilities-never-get-exploited-closing-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T06:01:46.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/instasla/why-most-critical-vulnerabilities-never-get-exploited-closing-the-static-to-runtime-context-gap-2oef"
  },
  "original_language": "en",
  "account": "Modern Application Security (AppSec) teams are overwhelmed with theoretical risk signals. Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools excel at identifying vulnerable code and outdated packages. However, without runtime context, they produce a deluge of alerts that often don't reflect true risk. A 2025 study by KAUST researchers found a 92% false-positive rate in downstream vulnerability scanners, which they tied to code that never executes. Endor Labs' State of Dependency Management research revealed that 60-80% of flagged dependency vulnerabilities exist in code paths that aren't called, and reachability analysis can eliminate 60-95% of false-positive SCA alerts. This discrepancy creates alert fatigue, friction between security and engineers, and missed Service Level Agreements (SLAs) for exploitable vulnerabilities. Closing this gap requires shifting from static scanning to runtime-informed triage.",
  "summary": "runtime contextual security prioritize SAST alerts behavioral telemetry DevSecOps reduce false positive security alerts SAST false positives runtime triage security static scan noise reduction unreachable code vulnerabilities runtime exploitability analysis AppSec alert prioritization SAST alert overload SCA alert noise reachability analysis AppSec application security triage accepted risk audit…",
  "key_points": [
    "Modern AppSec teams overwhelmed by theoretical risk signals",
    "92% false-positive rate in downstream vulnerability scanners",
    "Reachability analysis can eliminate 60-95% of false-positive SCA alerts"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}