🛡️ Security

Stakeholder-Specific Vulnerability Categorization (SSVC)

A decision model, used by CISA, that prioritizes a vulnerability using factors such as active exploitation status and automatability rather than a single static score. Because those inputs change over time, an SSVC decision can escalate a bug that a fixed CVSS score would leave unchanged.

📚 Deep Dive

Learn Article

Why a Severity Downgrade in a Vendor Advisory Can Leave You Exposed

Vendor severity ratings expire. A bug scored low in August can be reclassified and exploited by September. How to build re-triage into a vulnerability program so a changed advisory reopens the ticket.

intermediate 5 min read

Back to Glossary