Smart-Diff - semantic risk delta
What changed in exploitability, not in the CVE count
A semantic delta over reachability and VEX state between two releases.
A count delta says how many identifiers arrived and left. Smart-Diff compares the two digests as risk states: which findings gained or lost an observed execution path, which VEX states moved, and which of those changes your policy evaluates.
It changes what a reviewer reads first, never the findings underneath.
Where it sits in the custody spine
- Source
- Build
- Scan
- Verdict
- Decision
- Deploy
- Watch
The delta is computed when a candidate digest is reviewed for promotion: the verdict carries what changed against the digest it replaces, and the decision seals it into the evidence.
Two readings of the same release
Illustrative example - demo phrasing, not a measured result.
A count-based tool reports
+3 CVEs
Three identifiers arrived with a base-image update and a dependency bump. The count says risk went up. It cannot say whether any of the three can execute.
Smart-Diff reports
+3 CVEs, exploitable surface decreased
The three additions sit on no observed execution path. One finding that was reachable and unfixed in the previous digest is gone. The material change is the removal.
"+3 CVEs, exploitable surface decreased" is a sentence a count-based tool cannot produce. It requires knowing which findings can execute, not how many exist.
What it actually compares
Smart-Diff is a diff over risk state, bound to two image digests: the release you run and the release you propose. ReachabilityAnalysis that proves whether vulnerable code is actually called by your application — filtering out false positives from scanner noise
Reachable-path changes
Which findings gained or lost an observed execution path between the base digest and the target digest. A finding that stops being reachable is a different event from a finding that disappears.
VEX state transitions
Statement movements such as affected to not_affected, recorded with the rationale behind them - a reviewer sees why the state moved, not just that it moved.
Policy-relevant deltas
Changes that cross a gate your policy evaluates: severity movements, fix availability, reachability class. Changes your policy ignores stay in the delta, ranked lower.
Bound to two digests, replayable like any verdict
The delta is recorded as a DSSE-signed attestation naming the base and target image digests. Its payload carries added, removed, and modified findings, the reachability gate result, and the list of material changes. Re-run it from the same two digests and the same evidence, and you get the same delta. DSSEDead Simple Signing Envelope - a simple, flexible standard for signing arbitrary data with cryptographic signatures
Why the count misleads
A release can add ten CVE identifiers in code that is never loaded and remove one finding that was reachable and unfixed. A count-based gate blocks that release - the safer one. Material-risk-change detection ranks the delta so the reviewer reads what moved exploitable surface first. The long tail is one filter away.
Context on the underlying finding population, not on deltas: ~85% of critical container vulnerabilities are in inactive code (Sysdig 2024 Container Security Report). A delta that only counts identifiers inherits that noise on both sides of the comparison.
Where the delta lands
Release review, before promotion.
- A candidate digest reaches review. Its verdict carries the delta against the digest currently approved in the target environment.
- The reviewer reads material changes first: what became reachable, what stopped being reachable, which VEX states moved and why.
- On promotion, the delta is sealed into the decision's evidence. When someone later asks why this release was allowed, the answer includes what changed since last time - not just a snapshot.
The boundary
Delta quality tracks reachability coverage. Reachability analysis covers Java, C#, Go, JavaScript, TypeScript, and Python. Outside those languages, Smart-Diff still records added, removed, and changed findings between the two digests, but it cannot claim exploitability moved, and it says so rather than reporting no change.