This is very cool, why not directly test the exploitability direct with harmless pods on the cluster for verification? If it's only model based as a defender I'd worry about how many % of misses arise. Even frontier models are going to miss some stuff, a programmatic gate seems prudent.

Not trying to be negative, do think it's a good approach youve got, but the modern reality of dealing with cve's and compliance is to just fix them because it's a massive headache trying to write exemptions for all the ones that don't matter. Been my experience anyway.