Home / Knowledge hub / SSVC
Knowledge hub
SSVC
A decision tree that tells you whether to act on a vulnerability now or later.
What it means
SSVC stands for Stakeholder-Specific Vulnerability Categorization. It is a decision tree developed by Carnegie Mellon's CERT Coordination Center, and CISA published its own version. Instead of a score, it ends in a decision such as Track, Track*, Attend or Act, each with a meaning agreed in advance.
You answer a few plain questions about a flaw: is it being exploited, can it be automated, how bad is the technical impact, how much does the affected system matter to your mission and to people. The path through the tree gives the action.
Why it matters
A severity number says how bad a flaw could be. It does not say what to do on Monday. Teams with thousands of findings need to decide an order, and a score alone sends them after the highest number, not the flaw most likely to hurt them.
SSVC states its reasoning in words that a manager can read and challenge. 'Act' because it is under active exploitation on a system that matters is easier to defend to an auditor than 'we fixed everything above 7'. It also shows where you chose to wait, and why.
How it shows up
It is used by CISA for its own prioritisation and is open for anyone to adopt. In practice you map the decision points to data you have: exploitation status from the KEV catalog or threat feeds, and the importance of each system from your asset inventory. Then you record the decision per finding.
The weak point is the inputs. If you do not know which systems matter, or whether a flaw is under exploitation, every branch is a guess. SSVC pairs well with EPSS and CVSS: those describe the flaw, while SSVC turns the information into an action for you.
Questions people ask
SSVC, answered
Is SSVC a replacement for CVSS?
Not exactly. CVSS describes how severe a flaw is. SSVC decides what to do about it for a given organisation.
Many teams use CVSS as one input and SSVC for the final call.
What are the SSVC outcomes?
In CISA's version: Track, Track*, Attend and Act. Track means watch it in normal processes. Attend means involve senior staff and act sooner. Act means act as soon as possible.
The wording and outcomes can differ in other published trees.
Who made SSVC?
It came from the CERT Coordination Center at Carnegie Mellon University's Software Engineering Institute, with later work with CISA.
Both publish their documentation openly, and the decision trees can be adopted without a licence fee.
Do we need special tools?
No. A spreadsheet works. Tools exist to automate the answers, but the decisions are the same. Keep a written reason beside each result.
Start by recording your answers for the flaws you already track.
How is it different from EPSS?
EPSS predicts the probability a flaw will be exploited in the next 30 days. SSVC is a decision method that can use that kind of data as an input.
One estimates likelihood, the other chooses an action.
Sources
Where this comes from
Related
Terms that sit next to this one
Risk-based prioritisation
Ordering fixes by real-world risk, not just by the raw severity score.
EPSS
A score estimating how likely a vulnerability is to be exploited in the next thirty days.
CISA KEV catalogue
A government list of vulnerabilities known to be exploited in real attacks.
CVSS
A scoring system that turns a vulnerability into a number out of ten.
Exploitability
How easily and reliably a flaw can be used in practice.
Act now, or track it?
Proof helps the decision: each of our findings shows what was actually exploited, with the request and response, and severity and confidence are kept separate. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.