SCA tools rank findings with severity scores, exploitation evidence, reachability, or a mix. To test them, take your top thirty findings, label each by hand as act now, plan, or ignore, and see which ranking puts your act-now items first. The one that matches your judgment saves you time.
The common signals
Severity score. A standardized rating of how bad a flaw could be in general. Useful, universal, and blind to your context. Many findings share high scores, so it sorts poorly on its own.
Exploitation likelihood. Statistical estimates of how likely a flaw is to be exploited soon. Helpful for ranking, though a low estimate is not a guarantee of safety.
Known exploitation. A listing from a government or vendor source that a flaw has been used in real attacks. Narrow but strong evidence.
Reachability. Whether your code calls the vulnerable function. Specific to your application, and dependent on language support.
Asset context. Whether the affected service is internet-facing, handles sensitive data or is a prototype. Usually your input, not the tool's.
Fix availability. Whether an upgrade exists. It changes the priority from plan a response to just do it.
Why combining helps
Each signal fails alone. Severity ignores context, likelihood is a probability across the world and not your system, and reachability may not resolve dynamic calls. Together they check each other. A finding that is severe, known to be exploited and reachable in a public service is easy to place. A finding that is severe on paper but unreachable and unexploited can wait.
A small test
Take thirty findings from a trial repository. Without looking at the tool's ranking, label each: act now, plan this quarter, or ignore for now. Use your own knowledge of the services.
Then compare. Sort by severity only and count how many act-now items fall in the top ten. Repeat with the tool's combined ranking. The difference tells you what the extra signals buy you.
Ask engineers to do the labeling with you, since they know which code paths are live.
Check for transparency
A ranking you cannot explain will not be trusted. For each top item, can you see the signals behind its position? Can you adjust the weights or override a result and have that recorded? Opaque scores that cannot be challenged tend to be ignored after a few surprises.
Try it yourself
Open the demo and look at the evidence shown for a finding. Check which signals are listed and how they would change the order.
Click through it at your own pace, or open it full screen.
Where Safeguard fits: Safeguard combines reachability analysis with dependency scanning, and the free scan at gold.safeguard.sh/scan lets you see how your own findings are ordered.
Quick check
Is a low exploitation estimate a reason to ignore a finding?
No. It lowers priority but does not remove the risk, so track it and review when circumstances change.
Last reviewed: 19 October 2026.
