Source note
DEPTEX: Organization-First, Open Source Dependency Risk Monitoring
Summary
Deptex is an open-source dependency-risk monitoring platform that ranks OSS risk by organizational exposure, asset ownership, and execution context. Its main idea is to combine an organization graph, programmable policy checks, CPG-based reachability, and LLM verification to cut low-value security alerts.
Problem
- Existing SCA and reachability tools often score vulnerable components without enough context about where and how the vulnerable code runs, which creates alert fatigue.
- Enterprises need policies tied to asset tiers, legal review, owners, and internal APIs, but many tools only offer fixed compliance controls.
- The paper cites operational gaps: only 15% of CISOs report full visibility into OSS usage, 72% of professionals call supply-chain security a critical blind spot, and only about 32% of automated dependency PRs are merged.
Approach
- Deptex models organizations, units, assets, components, actors, and risk signals as a typed property graph, then rolls risk up from assets to teams and the full organization.
- Its Security “As Code” engine runs policy logic for status changes, component rules, PR gates, and notifications, including calls to internal systems such as a Legal API or PagerDuty.
- Execution Path Dominance (EPD), also called Depscore, starts with Code Property Graph slices that trace the path from an asset entry point to a vulnerable dependency sink.
- A constrained LLM checks the sliced code for exposure type and custom sanitization; public APIs get higher exposure weight, while sanitized paths are assigned an EPD of 0.0.
- The score then applies geometric decay, EPD = W_entry × α^d, where d is path depth and α is an attenuation factor such as 0.85.
Results
- The excerpt does not report a controlled benchmark, user study, or measured alert-reduction rate; it gives operational scenarios and a feature comparison.
- In the Depscore scenario, a CVSS 9.8 vulnerability is reachable in 10 repositories; Deptex downgrades 8 because they are offline batch-script paths 6 function hops deep, while 2 public unauthenticated API paths receive an EPD of 92.
- The scoring examples assign W_entry = 1.0 for public-facing APIs and W_entry = 0.1 for internal background tasks; sanitized paths are forced to 0.0.
- In the tool table, Deptex is listed as supporting 7 of 7 compared capabilities: CI/CD and ticketing integrations, license and compliance auditing, org-wide portfolio view, self-hosted deployment, structural CPG reachability, contextual vulnerability scoring, and programmable policy.
- The table claims Deptex has 3 capabilities that Dependabot, Dependency-Track, and Snyk lack as listed: full structural CPG reachability, contextual vulnerability scoring, and programmable “As Code” policy.