SSVC outcomes explained: Track, Track*, Attend and Act

SSVC, the Stakeholder-Specific Vulnerability Categorization, is a decision tree, not a score. CISA's version ends in one of four outcomes: Track, Track*, Attend or Act. Five inputs feed it: exploitation status, technical impact, automatable, mission prevalence and public well-being impact. Each outcome says who must pay attention and how fast to remediate.

Where SSVC comes from

Carnegie Mellon University's Software Engineering Institute created SSVC in 2019 with CISA. In 2020 CISA worked with the SEI on a customized tree for vulnerabilities relevant to the US federal government, state, local, tribal and territorial governments, and critical infrastructure. CISA says using it has helped it prioritize both its response and its public messaging.

The CISA tree closely resembles the standard "Coordinator" tree, which suits organizations that must judge the effect of a flaw on at least one outside organization. For other missions, the SEI whitepaper describes other trees.

The four outcomes

As CISA describes them:

• Track: no action needed now. Keep watching, and reassess if new information appears. Remediate within standard update timelines.
• Track*: the flaw has specific characteristics that may need closer monitoring for change. Also remediate within standard timelines.
• Attend: it needs attention from supervisory level people inside the organization. Actions include asking for help or information, and possibly publishing a notice. Remediate sooner than standard timelines.
• Act: it needs supervisory and leadership level attention. Internal groups would typically meet to settle the response and execute it. Remediate as soon as possible.

Notice that the outcomes are about who gets involved as much as how quickly the fix lands.

The five inputs

Exploitation, technical impact and automatable describe the flaw. Mission prevalence and public well-being impact describe consequences for the stakeholder.

Using the SEI's public decision point pages:

• Exploitation has three values: None, Public PoC and Active. It is the present state of exploitation, not a prediction. A predictive system such as EPSS can supplement it, but that is a separate input.
• Automatable asks whether an attacker can reliably automate reconnaissance, weaponization, delivery and exploitation. Yes or No.
• Technical impact is Partial or Total, meaning limited control or information exposure versus total control or total disclosure of the system.

A design choice worth copying

The SEI says decision point values are ordered sets. The ordering lets the tree check itself: if one set of answers is at least as severe as another on every dimension, its outcome cannot be lower.

SSVC also refuses an "unknown" value. It asks you to pick the reasonable assumption based on history. For Automatable, if nothing is known, the safer answer is Yes. That stops a blank from quietly lowering urgency.

Using it without a federal mission

You can borrow the structure. Write your own small tree with the inputs you can fill in reliably. For many private teams that is exploitation status from KEV, automatable and technical impact from the CISA Vulnrichment data, and an exposure or business criticality flag from your asset inventory. Then give each outcome a named owner and a time limit.

CISA also offers an SSVC calculator that exports results as PDF or JSON.

Safeguard's policies and gates can encode the outcome of a tree like this, for instance blocking a release on a flaw that reaches your Act tier. See the exploitability check demo.

Quick check

Sources

• CISA: Stakeholder-Specific Vulnerability Categorization (SSVC)
• SEI SSVC documentation: Exploitation
• SEI SSVC documentation: Automatable
• SEI SSVC documentation: Technical Impact
• SEI SSVC documentation: decision points overview
• CISA Vulnrichment repository

Last reviewed: 19 October 2026.