What they did
For every CVE flagged by Wiz security scanner, uses Claude Code for reachability analysis to determine actual risk.
How it went
Ongoing workflow; ~$200/month usage for security analysis.
Every CVE Wiz flags gets a Claude Code reachability check
A scanner flags CVEs; the real question is which ones can actually be reached. For every one Wiz flags, Claude Code runs a reachability analysis, for about $200 a month in usage.
Result Real risk checked for about $200 a month
“For every CVE that Wiz flags, I have Claude Code check for reachability analysis”
Spotted: found in the wild. Details are as reported by the source above and have not been independently verified.
Try it yourself with Claude Code
A CVE was flagged in [dependency]: [CVE ID]. Analyze if it's reachable in my codebase: [describe how dependency is used]. Check: is the vulnerable code path actually called? Is it in production? Assess actual risk vs theoretical risk.
A starting prompt written by Agents in the Wild. Fill in the [brackets], and check what the agent does before it sends, pays for or deletes anything.