Function Call Analysis

Function Call Analysis is a technique used to determine if a vulnerable code path is actually reachable during program execution. This technique originates from program analysis and is critical for reducing false positives in software security. According to NIST's VEX (Vulnerability Exploitability Exchange) concept, a vulnerability is only actionable if it is reachable in the specific software configuration. This analysis complements the Software Bill of Materials (SBOM) by providing context on which vulnerabilities are truly exploitable, rather than just present in the codebase. This distinction is vital for effective risk-based vulnerability management and compliance with international standards like ISO/IEC 27001 and the EU AI Act's software security requirements.

Practical application involves three stages: first, generating a high-fidelity SBOM using lock files from package managers to ensure accurate dependency mapping. Second, executing function call analysis to prune unreachable vulnerabilities, which can be up to 63.3% of total alerts. Third, issuing VEX documents to stakeholders to communicate the actual exploitability of identified vulnerabilities. For example, a Taiwanese semiconductor firm could use this to prioritize patching of critical flaws in production firmware while ignoring unreachable vulnerabilities in legacy libraries, reducing patching-related downtime by 30% and improving compliance with the EU's Cyber Resilience Act（CRA）and the Taiwan Cyber Security Management Act.

Taiwan enterprises typically face three challenges: technical expertise shortage, high tool costs, and integration into fast-paced DevOps cycles. To overcome these, companies should adopt a phased approach: start with open-source tools like LLVM or Soot for initial implementation, then transition to commercial SAST/DAST solutions as needed. Building a dedicated DevSecOps team with expertise in both software-defined security and regulatory compliance is essential. The priority should be focusing on Internet-facing applications first, where unreachability risks are highest, followed by internal systems. A well-planned implementation can be achieved within 6 to 12 months with a focus on ROI-driven tool selection and staff upskilling.

Winners Consulting Services Co., Ltd. specializes in Function Call Analysis for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact