← All Terms

Stakeholder-Specific Vulnerability Categorization

SSVC

A decision-tree method, used by CISA, that turns facts about a vulnerability and the organisation's mission into one of four actions.

Governance & Risk

Stakeholder-Specific Vulnerability Categorization is a way of deciding what to do about a vulnerability instead of scoring it. CISA’s version walks a decision tree over five points: exploitation status, technical impact, whether exploitation can be automated, mission prevalence and public well-being impact. The result is one of four decisions: Track, Track*, Attend or Act.

Its strength is that it brings the organisation into the answer. The same flaw can be Track for one agency and Act for another, because the systems it affects matter differently to each. That is the part a severity score cannot supply.

For AI agents, SSVC is a natural second step after an agent-adjusted severity score. The score says how far a flaw can travel through the agent; the decision tree says what is at the end of that reach and how fast leadership needs to hear about it.

Read more on this
Security

Agent-Aware Vulnerability Management Ranks Flaws by What the Agent Can Do

A vulnerability score describes a flaw. It says nothing about the AI agent standing behind it: how freely it acts, what it is allowed to touch, which tools it can call, what it remembers and which business process it runs. Agent-aware vulnerability management adds those five things to exploitability before deciding what to fix first. ISO/IEC 27090:2026, published in October, gives the threat side of the same picture. Here is how the two fit together and how to run it.