ssvc-SKILL.md

Prioritize vulnerability remediation by applying the CISA SSVC decision tree to scanner results and threat intelligence. The framework evaluates exploitation status, technical impact, automatability, mission prevalence, and public wellbeing to output actionable remediation timelines.

Triage CVEs from Nessus or OpenVAS by ingesting CSV scanner exports and enriching them with KEV, EPSS, and NVD data. This process applies the SSVC decision tree to generate prioritized actions like Act, Attend, Track, and Track* with corresponding SLAs.

Yes, you can use SSVC decision points for security operations ticketing by generating consolidated triage reports. These reports provide recommended actions and remediation timelines directly suitable for security operations workflows and ticketing systems.

SSVC triage compares to CVSS by shifting from static severity scores to dynamic, risk-based prioritization. While CVSS measures inherent severity, SSVC integrates threat intelligence like KEV and EPSS to produce actionable outcomes like Act or Track based on environmental context.

Vulnerability triage with SSVC works with asset inventory data by applying the mission prevalence decision point. Ingesting asset inventory context allows the framework to align risk-based prioritization across CVEs from scanners with your specific operational environment.