CVE Exploitability Analysis

CVE Exploitability Analysis uses Aikido's LLM agents to assess open-source dependency CVEs against your actual codebase. Instead of treating every CVE with the same urgency, the agent reads how the vulnerable package is used in your repository and decides whether the finding is truly exploitable in your environment, then takes the triage actions you allow.

This is a credit-based, workspace-wide automation. You configure it once in Triage Settings, and Aikido runs analysis on matching open CVE findings each night. You can also trigger a run on demand and review every run in the history.

Use cases

• ✨ Reduce dependency noise: Automatically ignore or downgrade CVEs that aren't exploitable in your code
• 🎯 Prioritize real risk: Upgrade severity when the agent finds a CVE is easier to exploit than the base score suggests
• ⚙️ Control automation: Choose which actions run automatically and which require your approval
• 🔍 Get codebase-specific reasoning: Go beyond generic CVE descriptions with analysis grounded in how you use the package

How it works

CVE Exploitability Analysis triages your existing open dependency findings. Aikido's LLM agents assess each CVE against how the package is used in your code, then apply the actions you've allowed, such as changing severity, snoozing, or ignoring the finding.

When a finding is ignored, you'll see the reason CVE determined not exploitable in the issue's severity breakdown.

This complements reachability analysis, which filters findings with no execution path to vulnerable code. CVE Exploitability Analysis adds codebase-specific LLM reasoning on top.

Credits and availability

• 1 Aikido Credit per CVE triage: Each CVE the agent analyzes consumes one credit from your Aikido Wallet.
• Admin access required: Only workspace admins can view and change CVE Exploitability Analysis settings.

Configure CVE Exploitability Analysis

1

Open the settings

Go to Settings → Triage, find the CVE Exploitability Analysis section, and click Manage.

2

Enable CVE Exploitability Analysis

Turn on Enable CVE Exploitability Analysis to edit the fields below. When enabled, Aikido runs analysis on all open findings that match your configured severity and repository scope.

3

Set the scope

• Minimum Severity: Choose which findings get triaged: Critical only, High and above, Medium and above, or All severities.
• Repositories: Select which repositories to run analysis on. Start with a smaller scope to test the feature without spending too many credits at once.

4

Choose allowed actions

Under Allowed Actions, set each outcome to Fully Automated or Human Approval:

• Downgrade: Lower the severity when the CVE is less risky in your codebase
• Upgrade: Raise the severity when exploitability is higher than the base score suggests
• Snooze: Temporarily hide the finding until a specified date
• Ignore: Remove the finding from your feed when the CVE is not exploitable in your environment

With Fully Automated, the agent applies the action immediately after analysis. With Human Approval, the agent proposes the action and waits for you to approve it from the analysis history.

5

Set a spend limit

Set a Spend Limit per Day to cap how many credits analysis can use in a 24-hour period (default is 100). The Cost to Inbox Zero estimate shows how many CVEs match your scope and how many credits a full run would use, alongside your available credits.

What the agent can change

Action	When it's used	What you'll see
Downgrade	The CVE is real but less exploitable in your code than the base severity suggests	Severity score decreases with an agent-provided reason
Upgrade	The CVE is more exploitable in your code than the base severity suggests	Severity score increases with an agent-provided reason
Snooze	The finding needs attention later, not now	Finding is snoozed until the date the agent sets, with a reason
Ignore	The CVE is not exploitable in your environment	Finding is ignored with the reason CVE determined not exploitable

Severity changes only apply when the finding's current severity still matches what the agent analyzed. If the severity changed between analysis and action (for example, due to another rule), the change is skipped to avoid conflicting updates.

Run analysis on demand

Analysis runs automatically each night, but you don't have to wait for the nightly job. In the CVE Exploitability Analysis section of Advanced Settings, click Start Analysis to queue a run immediately for the CVEs matching your scope.

Each run respects your daily spend limit and available credits. Only one run happens at a time. While a run is in progress, Start Analysis is disabled and shows An analysis is already in progress. If there's nothing to do, Aikido tells you why (for example, you're out of credits, the daily spend limit is reached, or no matching issues were found).

Review analysis history

Every run is recorded so you can see what the agent analyzed and what it did. Click View History in the CVE Exploitability Analysis section to open the CVE Exploitability History page.

The history table lists each run with its date, package, repository, and number of CVEs analyzed, along with the triage actions taken (ignore, snooze, upgrade, downgrade). A purple pending badge marks actions the agent proposed but didn't apply. Use the search and repository filters to narrow the list.

Click any run to open its detail, which shows:

• An agent-written summary of the run
• The issues analyzed, with each CVE's action taken and the agent's reasoning
• A timeline of the run

Approve proposed actions

When an action is set to Human Approval, the agent records its recommendation but doesn't apply it. In the run detail, pending actions appear as Approve Ignore, Approve Snooze, Approve Downgrade, or Approve Upgrade. Click the badge to open the relevant triage flow, prefilled with the agent's reasoning. After you confirm, the action is marked as executed in the history.

Important notes

• Analysis runs each night for workspaces where the feature is enabled, and can also be started on demand. New findings that match your configuration are picked up on subsequent runs.
• A daily spend limit caps how many credits analysis can use per day (default is 100). Runs stop once the limit is reached and resume the next day.
• The agent needs read access to your connected repositories to analyze how packages are used.
• Only one analysis task per repository and package runs at a time. Duplicate runs for the same package are prevented while a task is pending.
• Changing an action from Fully Automated to Human Approval does not undo actions the agent already took.