SSVC.pm: Stakeholder-Specific Vulnerability Categorization on CPAN

If you work anywhere near vulnerability management, you’ve run into the CVSS problem: a single severity number that tells you almost nothing about what to actually do. CVSS was never designed to be a triage tool, and treating it like one is how organizations end up “patching everything” or, worse, patching nothing because everything looks equally urgent. SSVC (Stakeholder-Specific Vulnerability Categorization), developed by Carnegie Mellon’s SEI (CERT/CC) and later adapted by CISA into its own decision tree, takes a different approach: instead of a score, it’s a decision tree.