Six months ago, Boost acquired SecureIQx. Today we’re shipping the technology that team built, ThreatRank, inside Boost ASPM. ThreatRank tells you whether your code can reach each open-source CVE in a repository.
Security teams face more of those CVEs every month, because researchers now point AI models at open-source code. Anthropic alone used Claude Mythos Preview to scan more than 1,000 open-source projects and flagged 6,202 likely high- or critical-severity vulnerabilities, and Anthropic says the hard work now starts after discovery, with verification and patching. Maintainers publish a CVE with each fix, and every AppSec team that depends on the package then has to judge that CVE against its own application. A team can sort the pile by severity and EPSS, but an engineer still opens each advisory and traces the call chain by hand to learn whether the application calls the vulnerable code.
ThreatRank does that tracing for every open-source CVE, using a call graph of your code and a small language model trained for this one job. Boost marks each CVE high-threat or low-threat on the SCA finding your team already works from, with no separate reachability product or runtime sensor to deploy.
ThreatRank Follows Calls Across More Than 20 Languages
Before ThreatRank, Boost checked reachability in Go and Rust only. ThreatRank parses more than 20 languages, including Python, JavaScript, TypeScript, Java, Kotlin, Scala, C, C++, Ruby, and PHP, and it builds one call graph that crosses language boundaries, so it catches a Node service that shells out to a Python script or a Go binary that runs a Ruby task. From each entry point in the application, ThreatRank walks that graph outward and marks every function an attacker could plausibly reach.
ThreatRank can only use that graph if it knows what code to look for, and maintainers often write advisories too vaguely to say. So Boost maintains its own corpus of every open-source CVE published since 2020 that maps to a package on deps.dev (more than 50,000 advisories, with 50 to 100 new ones each day). We pull each advisory from OSV, NVD, and deps.dev, add patch-level detail, and rewrite the description around the mechanism behind the flaw. For Log4Shell, the original advisory says JNDI features don’t protect against attacker-controlled LDAP endpoints, and our rewrite explains that Log4j evaluates nested lookups such as ${jndi:ldap://...} through its JndiLookup component whenever the application logs a formatted message. ThreatRank can look for that code path in your call graph.
We Score Every CVE With a Small Language Model That Runs in Your CI
ThreatRank never sends your source code anywhere to score it. The SecureIQx team could have piped every code snippet to a frontier LLM, but customers would have had to ship source code to a third party on every scan, so the team built a small language model instead and trained it to answer one question: how strongly does this piece of code relate to this vulnerability? They fine-tuned hundreds of candidate models on tens of thousands of code snippets and vulnerability descriptions that security researchers labeled by hand before choosing the one we ship.
Boost runs that 91 MB model on a standard CPU, in the same CI job as your tests, and it scores thousands of snippets without a GPU. Your team gets the same answer for the same repository and CVE on every run.
We keep training it, too. As new CVEs and labeled examples come in, we fine-tune, validate, and export a new version automatically without adding parameters, so the model improves without slowing your scans or demanding bigger hardware.
We’d Rather Flag One Extra CVE Than Miss a Real Exposure
If ThreatRank can’t rule out that your code reaches a vulnerability, it keeps the CVE high-threat. A low-threat result means ThreatRank found no evidence of exposure, so your team can move those CVEs down the list and come back to them after the high-threat work.
Teams that want more than a verdict can turn on ThreatRank Pro with their own LLM key. Pro sends the curated evidence pack (never the whole repository) to the model, which writes a justification, a suggested fix, and an attack scenario for each high-threat finding, so the engineer reviewing it starts with an argument to check.
ThreatRank Pro caught 87% of the high-threat CVEs in our benchmark and cut the triage queue by 71%.
Boost’s own researchers built that benchmark by hand during due diligence, labeling every CVE in older, pinned versions of popular open-source projects. We ship ThreatRank with a more cautious threshold than the benchmark used, so expect to review a few more findings and miss fewer real exposures.
Turn On ThreatRank in Your Boost SCA Settings
New customers get ThreatRank by default when they turn on Boost SCA scanning. Existing customers can enable reachability analysis in their Boost SCA settings, and our team can walk them through it. ThreatRank Pro needs only your own LLM key. Book a demo to see ThreatRank sort the open-source CVEs in your own repositories.
.svg)
