A map of which functions call which — the foundation of reachability and taint analysis.
A call graph is a directed graph whose nodes are functions and whose edges represent "caller to callee" relationships. If function A invokes B, there is an edge from A to B. Chase enough of those edges and you get a complete map of how execution can flow through a program.
It sounds simple — and in the small it is — but a production call graph has to resolve dynamic dispatch, interfaces, reflection, callbacks, and cross-package edges through hundreds of dependency versions. Almost every interesting program analysis, from reachability to taint to dead-code detection, starts from this structure.
Building a useful call graph is an exercise in symbol resolution at scale:
1.2.0 and 1.3.5 can expose different APIs, and the graph has to reflect that.Without a call graph, a security analyzer is guessing. It can tell you that a vulnerable function exists somewhere in your dependencies, but it cannot tell you whether your code actually calls it. That is the difference between "1,400 CVEs in your SBOM" and "22 CVEs reachable from your code."
Call-graph quality also sets the ceiling for every downstream technique. A taint analyzer that runs on a sloppy graph produces sloppy findings. The engineering investment in graph accuracy pays off in every report the platform generates.
Reachability, taint, dead-code elimination, change-impact — all of them start by walking a call graph. Without it, the analyzer is pattern-matching.
The interesting flows go through your dependencies. A graph that stops at the package boundary misses exactly the paths that matter for supply-chain risk.
Edges are resolved against the exact dependency version in the lockfile — so the graph reflects what actually ships, not a generic snapshot of the ecosystem.
Reflection and dynamic dispatch get marked as uncertain rather than silently dropped. Downstream stages can choose whether to trust or quarantine those paths.
When a single file changes, the graph is updated incrementally — so reachability on a PR completes in seconds, not minutes.
The call graph is the substrate underneath reachability analysis, taint analysis, and exploit-path reasoning in Griffin AI. Every other concept on this page relies on it being accurate.
Point Safeguard at a repo. Watch the call graph build across your first-party code and every dependency.