triaging-vulnerabilities-with-ssvc-framework

SSVC prioritization evaluates five decision points: exploitation status, technical impact, automatability, mission prevalence, and public well-being. Feeding these into the CISA decision tree yields one of four outcomes (Track, Track*, Attend, Act), each mapped to a remediation SLA.

Download the CISA Known Exploited Vulnerabilities JSON feed and check whether the CVE ID appears in the vulnerabilities list. Presence in KEV maps to an Active exploitation status in SSVC, which typically escalates the outcome to Attend or Act.

CVSS measures theoretical severity of a vulnerability, while SSVC produces an operational decision based on real exploitation evidence, automatability, and mission context. SSVC uses CVSS vector elements like AV, AC, and UI as inputs but outputs an action rather than a score.

Yes, the workflow accepts Nessus CSV exports and OpenVAS XML reports via the processing script's format flag. The parsed findings are evaluated against the decision tree and written to a structured JSON triage report.

SSVC assigns Track when there is no evidence of exploitation and the mission impact is limited, even if CVSS severity is high. Verify that KEV and EPSS data are current and that mission prevalence reflects your actual asset inventory rather than a default value.