VulnGraph AI

• 

  default

• 

  errornotfound

• 

  fastapi

• 

  httpvalidationerror

• 

  output

• 

  simulation

• 

  vulnerabilities

Inspiration

Modern applications depend on hundreds of third-party packages, but traditional vulnerability scanners often treat every vulnerability equally. We wanted to solve the bigger problem: which vulnerabilities actually matter?

This inspired us to build VulnGraph AI, a system that goes beyond simply detecting vulnerabilities by understanding dependency relationships, transitive risks, exploitability, and real-world context.

What it does

VulnGraph AI converts an SBOM into an interactive dependency graph and identifies both direct and hidden transitive vulnerabilities. It combines CVSS, EPSS, patch lag, dependency depth, reachability, and ML-based prioritization to calculate contextual risk.

Instead of overwhelming developers with hundreds of alerts, it highlights the top actionable vulnerabilities, recommends fixes, generates remediation guidance, and can act as a security gate in CI/CD pipelines.

How we built it

We designed VulnGraph AI as an end-to-end security pipeline:

SBOM Ingestion → Dependency Graph → Vulnerability Intelligence → Context-Aware Risk Scoring → ML Prioritization → Remediation → CI/CD Security Gate

The system uses React + Tailwind CSS for the frontend, FastAPI + Python for the backend, Scikit-learn/XGBoost for ML-based risk prioritization, and Docker + GitHub Actions for DevSecOps integration. It supports SBOM standards including CycloneDX and SPDX.

Challenges we ran into

The biggest challenge was moving beyond simple CVE detection and building meaningful dependency context. A vulnerability several levels deep in a dependency tree can be difficult to identify and prioritize.

We also had to design a risk model that combines multiple signals rather than relying only on CVSS, while keeping the results understandable and actionable for developers.

Accomplishments that we're proud of

We are proud of building a complete concept around SBOM-first security, including transitive dependency tracing, contextual risk scoring, ML-powered prioritization, automated remediation, and CI/CD security gates.

Our biggest accomplishment is shifting the focus from “How many vulnerabilities exist?” to “Which vulnerabilities should developers fix first?”

What we learned

We learned that effective software supply-chain security requires more than vulnerability databases. Dependency relationships, exploit probability, patch availability, and application context can significantly change the real-world importance of a vulnerability.

We also learned how important it is to make security insights explainable and actionable rather than simply presenting developers with another list of alerts.

What's next for VulnGraph AI

Next, we plan to expand support across more ecosystems and SBOM formats, improve the ML risk model with richer real-world security signals, strengthen automated remediation, and deepen CI/CD integration.

Our long-term goal is to evolve VulnGraph AI into an intelligent software supply-chain security command center that can detect, prioritize, remediate, and prevent dependency risks throughout the development lifecycle.

Built With

• docker
• python
• react-native