SSVC Explained: How CISA's Decision-Tree Model Replaces “Patch Everything Critical”
Originally reported viaCISA — Stakeholder-Specific Vulnerability Categorization (SSVC) resource page, SSVC Guide and SSVC CalculatorAsk ten security teams how they prioritise vulnerabilities and most will describe some version of the same rule: sort by CVSS score and work down from the top. The rule is simple, but it answers the wrong question. CVSS describes how severe a flaw could be in the abstract; it says nothing about whether anyone is exploiting it, whether the affected system is exposed, or what a compromise would mean for your organisation. Stakeholder-Specific Vulnerability Categorization — SSVC — was designed to close exactly that gap.
Where SSVC comes from
SSVC was created in 2019 by Carnegie Mellon University's Software Engineering Institute, working together with CISA. In 2020 CISA built its own tailored decision tree on top of the framework, aimed at the vulnerabilities that affect the U.S. government, state, local, tribal and territorial bodies, and critical infrastructure operators. With CISA now retiring its weekly vulnerability bulletin and pushing a risk-based approach, SSVC has moved from a niche methodology to the agency's recommended way of deciding what to fix first.
The five questions CISA's tree asks
Rather than collapsing everything into one number, CISA's version of SSVC walks each vulnerability through five decision points. Exploitation: is there no evidence of exploitation, a public proof of concept, or confirmed active attacks? Technical impact: would successful exploitation give an attacker partial control or total control of the affected component? Automatable: can an attacker chain the steps of exploitation together reliably and at scale, without manual effort per target? Mission prevalence: how widespread and how essential is the affected product to the missions it supports? Public well-being impact: what is the potential harm to people, safety and society if it is compromised?
Four outcomes instead of a 0–10 scale
The answers lead to one of four decisions, each tied to an expected response. Track means no action is needed beyond standard remediation timelines, with continued monitoring in case the situation changes. Track* ("track star") also follows standard timelines, but flags that something about the vulnerability deserves closer watching. Attend calls for attention from supervisory staff and remediation faster than standard timelines, and may involve reaching out internally or externally for more information. Act is the top tier: leadership should be involved, and the vulnerability should be remediated as soon as possible.
The value of this structure is that it is explainable. When a vulnerability lands in Act, anyone can trace the path that put it there — active exploitation, automatable, total technical impact — and challenge any step. That is far easier to defend to an auditor, a board or an application owner than "it scored 9.1".
CVSS measures how bad a flaw could be. SSVC asks how bad it is for you, right now.
— Priya Kapoor, Vulnerability Research · Furix Feed
Tools CISA provides
CISA publishes a detailed SSVC Guide explaining each decision point and how to answer it, alongside an interactive SSVC Calculator. The calculator lets an analyst enter values for each decision point and returns the resulting decision, which can be exported as PDF or JSON — useful both for documenting individual decisions and for feeding results into ticketing or GRC systems.
Making SSVC work inside an enterprise
The decision points that describe the vulnerability itself — exploitation, technical impact, automatability — can largely be answered once and reused, drawing on sources like the KEV catalog and vendor advisories. Mission prevalence and well-being impact are different: only you can answer them, because they depend on what the affected asset does for your business. That is the "stakeholder-specific" part, and it is why SSVC works best when it is connected to a reliable asset inventory with business criticality attached.
- Read CISA's SSVC Guide and walk a handful of recent vulnerabilities through the SSVC Calculator to calibrate your team.
- Pre-classify asset groups for mission prevalence and public well-being impact so analysts are not re-deciding them for each CVE.
- Automate the exploitation decision point using the CISA KEV catalog and threat intelligence feeds.
- Map Track, Track*, Attend and Act to concrete SLAs and escalation paths in your ticketing system.
- Export SSVC decisions (JSON or PDF) as evidence for audits and exception reviews.
Stay ahead of the threat curve
Get the latest CVE advisories, threat actor intelligence, and detection engineering posts delivered to your inbox.
