Zennoxa Research
Reproducible security research from the team behind Zennoxa Shield — measured data on supply-chain, CI/CD and container risk, with the method and raw numbers so you can re-run every study.
Advisory Growth vs. Tooling Coverage: The Capacity Gap Is a Flow, Not Just a Stock
We bucketed every OSV.dev advisory by its record-publication year for 11 package ecosystems and overlaid the count of catalogued open-source security tools per language. Known-vulnerability advisories entering the public record grew 2.3x-6.6x over five years for most ecosystems, and recent years add hundreds to thousands per ecosystem against 2-13 open-source tools — up to 157 new advisories per tool per year for Rust. A reproducible measure of whether tooling capacity keeps pace with advisory inflow.
The Version-Drift Problem: Is a Published SAST 'Accuracy' Score Even Reproducible?
A single accuracy number on the OWASP Benchmark moves measurably from provenance alone — which benchmark version (v1.1 = 21,041 cases vs v1.2 = 2,740), which CWE subset was averaged, and how findings are matched. Computed live from the v1.2 ground truth: the official macro-average weights the smallest category 14.4x differently from a case-weighted average, and a fixed reference detector's headline swings 54.5 points from subset choice alone. A score with none of that pinned is not independently reproducible.
The SCA Coverage Gap: Where Dependency-Vulnerability Volume Piles Up vs. Where Open-Source Tooling Is Thin
We counted every advisory in OSV.dev's public per-ecosystem archives and joined it to the open-source, security-tagged scanners in the analysis-tools.dev catalog. Advisory volume and open-source tool availability are only weakly aligned: Rust (crates.io) carries 2,663 real advisories against 2 catalogued open-source tools, while Dart (Pub) and Elixir (Hex) have advisory volume but zero. A reproducible map of the 'SCA deserts.'
From Weakness to Weaponized: the CWE Classes Attackers Actually Exploit
Most disclosed vulnerabilities are never exploited — so which weakness classes are over-represented among the ones that are? We compared each CWE's share of the CISA KEV catalog to its prevalence across all 370,431 CVEs. Type Confusion is 20.5× over-represented among known-exploited bugs; Deserialization 14.5×; OS Command Injection 7.4×. A reproducible exploitation-lift ranking.
Exploited, but Not 'Critical': What a Single-Signal Queue Buries
Start from ground truth — the 1,653 vulnerabilities CISA records as exploited in the wild — and watch each single-signal triage queue bury a different slice. 71.1% of known-exploited CVEs are not rated CVSS Critical; 23.8% carry an EPSS probability below 0.10. Neither severity nor probability alone surfaces all of them. A reproducible cross-section of the KEV catalog.
The Backlog Economics of 'Criticals First': 8.7 Evidence-Free Bugs per Real One
If you work CVSS-Critical vulnerabilities strictly worst-first, how much of that queue carries any exploitation evidence? Of 30,409 Critical CVEs, only 3,124 (10.3%) are in CISA KEV or score EPSS ≥ 0.10. The other 89.7% have no public exploitation signal — 8.7 evidence-free Criticals for every one with evidence. A reproducible look at the cost of severity-only triage.
Nine in Ten 'Critical' CVEs Show No Sign Anyone Is Exploiting Them
We joined three free public datasets — NVD CVSS scores, FIRST EPSS probabilities, and the CISA KEV catalog — on CVE ID. Of 30,409 CVEs rated CVSS 9.0+ ('Critical'), 89.7% carry an EPSS exploitation probability below 0.10 and are absent from the KEV catalog. A reproducible measure of how much of a severity-first queue is urgent by label but by no exploitation signal.
State of Open-Source SAST 2026: 755 tools, but only 42 open-source security scanners
We parsed the public analysis-tools.dev catalog of 755 static-analysis tools. 86% are open source — but only 42 are open-source SAST (security) scanners, and 21 languages with an active linting ecosystem have zero open-source security scanner at all. A reproducible census of where open-source SAST exists, and where it doesn't.
Do popular projects pin their base images? We checked 25
Popular projects SHA-pin their GitHub Actions two-thirds of the time — but pin their Docker base images to an immutable digest only 7.6% of the time. Same supply-chain idea, a fraction of the adoption. Reproducible data across 25 repos.
Do popular container images drop root? We checked 25 projects
Half of the primary Dockerfiles in 25 popular infra and app projects don't set an explicit non-root USER in their final stage. A fair, caveated look at what static analysis can and can't tell you about container privilege.
State of GitHub Actions Pinning 2026: we checked 30 popular repos
Across 30 popular public repositories, 1 in 3 GitHub Action references still points at a mutable tag instead of a pinned commit — the exact pattern behind the tj-actions/changed-files and reviewdog compromises. Reproducible data.
Where static analysis is easy vs hard: a walk through 2,740 OWASP tests
The OWASP Benchmark's 2,740 labelled cases show a clear pattern: SAST nails pattern-local bugs (weak crypto at 100% precision) and struggles with anything that needs dataflow (SQL injection at 39% recall). Here's the whole scorecard — including where our own engine scores zero.