Track, Attend, Act: a simple scale for security news

CISA's SSVC guidance describes four outcomes for a vulnerability: Track, Track star, Attend and Act. You can borrow them for security news in general. Track means watch and fix on the normal schedule, Attend means escalate and move faster, and Act means leadership gets involved and you remediate as soon as possible.

What the four outcomes mean

According to CISA's SSVC page:

• Track: no action needed now. Keep monitoring and reassess if new information appears. Remediate within standard update timelines.
• Track star: has traits that warrant closer monitoring for changes. Remediate within standard timelines.
• Attend: escalate to supervisory level staff. Actions may include seeking help or information and issuing internal or external notices. Remediate sooner than standard timelines.
• Act: escalate to supervisory and leadership levels. Teams typically meet to set a response and then carry it out. Remediate as soon as possible.

The inputs behind the outcome

SSVC arrives at an outcome from five decision points: exploitation status, technical impact, whether exploitation is automatable, mission prevalence and public well being impact. You do not need the full tree to benefit from the idea. The first two questions, whether it is being exploited and how bad it would be if it worked, do most of the sorting.

Applying it to a news story

Ask four plain questions:

1. Is there evidence of exploitation against anyone?
2. If an attacker succeeded against us, how bad would it be?
3. Do we run the affected thing in a reachable way?
4. How important is the affected system to our work?

Then place the story:

• No exposure, no exploitation: Track.
• Exposure but no sign of attacks, low impact: Track, with a review date.
• Exposure, attacks seen elsewhere, meaningful impact: Attend.
• Exposure, active attacks, and an important system: Act.

Why a shared scale helps

Meetings about news often stall because people use "urgent" differently. A four word scale lets an engineer say "Attend, owner is Priya, update at 3pm" and everyone knows what it means.

Caveats

This is a team habit, not an official rating. Adapt the labels if your culture prefers other words, and keep the definitions written down. Revisit a label when facts change. A story that starts at Track can move to Act the same afternoon if exploitation appears.

Quick check

Sources

• CISA, Stakeholder-Specific Vulnerability Categorization

Last reviewed: 19 October 2026.