DEPTEX: Organization-First, Open Source Dependency Risk Monitoring
Henry Ruckman-Utting, Vrushal Nedungadi, Taiga Okuma, LeTian Wang, Stephen Ehebald + 1 more
TLDR
Deptex is an organization-first platform that uses graph-based analysis and LLMs to provide context-aware, programmable supply chain risk management for OSS dependencies.
Key contributions
- Introduces Deptex, a graph-based platform for organization-first, emergent supply chain risk monitoring.
- Proposes Execution Path Dominance (EPD) using CPG slicing and LLM verification for accurate vulnerability blast radius.
- Implements a programmable 'As Code' engine for custom governance, enabling dynamic policies and asset tiers.
Why it matters
This paper addresses critical alert fatigue in OSS dependency management by introducing a context-aware, programmable approach. Deptex's novel EPD method and 'As Code' governance empower organizations to proactively manage supply chain risks, moving beyond rigid compliance to efficient, aligned security.
Original Abstract
Open-source software (OSS) dependencies introduce systemic risks that are difficult to manage at scale. Existing Software Composition Analysis (SCA) and reachability tools generate severe alert fatigue by treating risk as an intrinsic component property, ignoring semantic context and forcing enterprises into rigid compliance frameworks. We present Deptex, an organization-first, graph-based platform treating supply chain risk as emergent. Deptex introduces Execution Path Dominance (EPD), fusing Code Property Graph (CPG) slicing with Large Language Model (LLM) semantic verification to calculate a vulnerability's true operational blast radius. To handle bespoke compliance, Deptex abstracts governance into a programmable ``As Code'' engine, enabling security teams to natively enforce dynamic pull request policies, custom asset tiers, and external API integrations. By shifting from reactive scanning to context-aware governance, Deptex enables proactive, efficient, and aligned supply chain risk management.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.