Teams catching exploits instead of chasing CVEs

AppSec triaged more than 400 CVSS-critical findings each sprint. Most were transitive dependencies never called in production or used only in test. The backlog outpaced the team's capacity.

After Oligo was deployed, its runtime dependency graph showed that just 9% of flagged packages had reachable production call paths. The team focused on those 9% and patched the highest-risk items within two weeks.

During rapid growth, the security team needed to verify that open-source dependencies behaved as expected at runtime. A quarterly audit found a transitive dependency with unusual network access patterns.

Oligo caught a compromised package beaconing to an external endpoint within 400 milliseconds of container startup. The alert showed the dependency path, target domain, and process context, enabling immediate isolation.

After the Log4Shell disclosure, the team needed to know which of its 40+ microservices ran vulnerable log4j versions and whether exploitation attempts had occurred. Manual inventory would have taken days.

Oligo found every process loading log4j-core in under three minutes. The runtime graph identified services actively calling the JNDI lookup path. Oligo had blocked JNDI-based outbound connections before the CVE was published through behavioral baseline deviation.