SupplyGraph models dependencies as directed attack trees. By computing upward topological reachability to root applications, we eliminate noisy CVE false alarms, calibrate real blast radius, and provide surgical package overrides