Operationalizing SSVC
summary
CISA explains how SSVC is used end-to-end: the agency implements the SSVC decision tree since April 2020, publishes the first three decision points for each CVE via full enrichment and the CVE record JSON via ADP, and has scored about 46,000+ CVEs since Feb 2024. Under 10% of those are taken further internally, ~8% are actioned, ~3% land on Act (often exploited) and ~5% on Attend. Example: CVE‑2023‑20593 (Zenble) scores high in CVSS but is labeled Monitor because exploit prerequisites are rare, which lets CISA “spin down” unwarranted emergency responses.
AI-written summary · about
chapters (11)
- 0:00Operationalizing SSVC
- 3:55CISA’s vulnerability role
- 7:03SSVC vs CVSS prioritization
- 10:17SSVC decision tree
- 14:33SSVC in CISA workflow
- 18:05Scaling SSVC decisions
- 20:56SSVC prerequisites
- 23:01SSVC enrichment sharing
- 26:57SSVC results overview
- 28:21Lessons and future
- 30:53Q&A
related talks
35mVulnrichment Playground
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
15mKeynote
24mSecurity Advisories and Vulnerability Prioritization in the Wild
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
46mThree Musketeers: CVE, CSAF, and VEX