Don't count vulnerabilities. Predict their blast radius.
A CVE is not a risk until you know where it can reach.
BlastGuard is a Supply Chain Blast-Radius Control Plane: it turns SBOM + runtime + exposure + VEX into an explainable decision — then proves remediation.
Case study: BlastGuard · Andrey Lesnikov
Discover → Trace → Decide → Enforce → Verify
Not another Syft → Grype → CVE dashboard.
The scanners already exist. BlastGuard is the decision layer on top.
Ordinary pipeline:
CVE → scan → 147 findings → dashboard → ticket
BlastGuard:
CVE → Dependency Graph → Runtime Reachability → Exposure → Criticality → Decision → GitOps
Example:
CVE-2026-1234
│
▼
openssl
│
├── payment-api:v41 → prod/payment-api → internet exposed
├── report-worker:v4.2 → staging only
└── ml-builder:v2.1 → not running
┌──────────────────────────────────────────────┐
│ BLASTGUARD │
│ CVE-2026-1234 │
├──────────────────────────────────────────────┤
│ Affected artifacts 3 │
│ Running workloads 2 │
│ Internet exposed 1 │
│ Reachable 1 │
│ POLICY BLOCK │
│ Reason exploitable CVE +… │
│ FIX payment-api:v42 │
└──────────────────────────────────────────────┘
No fake Risk 83/100. Decisions are ALLOW / WARN / QUARANTINE / BLOCK with an explicit reason.
| Stage | What happens |
|---|---|
| Discover | SBOM (Syft/CycloneDX/SPDX), vulns (Grype/Trivy/OSV), signatures (Cosign) |
| Trace | CVE → package → image → workload → service → ingress (+ transitive edges) |
| Decide | Policy over CVSS/EPSS/VEX/runtime/exposure/criticality/fix availability |
| Enforce | Admission (Sigstore policy-controller / Kyverno) — ALLOW/WARN/QUARANTINE/BLOCK |
| Verify | After patch: blast radius → 0 · REMEDIATION PROVED |
make demo # trace CVE-2026-1234 → BLOCK on critical path
make rehearse # what-if for a CVE
make prove # before/after remediation evidence./bin/blastguard rehearse CVE-2026-1234
./bin/blastguard rehearse image ghcr.io/justrunme/payment-api:v42Ask before production changes: if this becomes exploitable, what is our blast radius?
Build-time truth + runtime truth on one graph:
Source → Build → Image → Package → SBOM → Deployment → Pod → Service → Ingress
+ CVE / VEX / Signature / Provenance / Runtime
SBOM says the package exists.
Kubernetes says it is running.
Ingress says it is exposed.
Reachability says the path is live.
VEX says which copies are not_affected.
147 findings become 1 exploitable path.
cmd/blastguard/ CLI
internal/decide/ Explainable policy engine
internal/graph/ Digital twin model
config/decision-policy.yaml BLOCK/WARN rules (no scores)
fixtures/demo-graph.json Offline twin for demos/CI
api/crds/ BlastRadius, SecurityDecision, SupplyChainPolicy
docs/assets/ Lifecycle visual
Integrations (not reimplemented here): Syft, Trivy/Grype, OSV, OpenVEX, Cosign/Sigstore, GUAC, OPA, OpenTelemetry, policy-controller/Kyverno.
BlastGuard owns: control plane, data model, decision engine, rehearsal, evidence.
| Project | Loop | Prove |
|---|---|---|
| Architecture Rehearsal | Predict → Rehearse → Gate → Verify | change safety |
| TwinOps | Declare → Compose → Detect → Reconcile | convergence |
| AI Infra Control Plane | Evaluate → Decide → Approve → Verify | governance |
| Kanister Recovery | Protect → Validate → Restore → Prove | recoverability |
| BlastGuard | Discover → Trace → Decide → Enforce → Verify | supply-chain safety |
Assumptions → evidence.
Apache-2.0 © Andrey Lesnikov