Lion Cipher Lab
Turn a CVE into a decision with SSVC
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A CVSS score is a measurement, not a decision. "This is a 9.8" does not tell operations whether to page someone at 2am or file a ticket for next quarter — and the single most common failure in vulnerability management is treating the severity number AS the decision, which floods the team with impossible "patch all criticals" lists. SSVC is the method CISA and CERT/CC use to fix that: you walk a small decision tree using your own organisation's context and it hands back one of four concrete actions. The output is transparent, repeatable and auditable — the same inputs always yield the same…
What you'll learn
- walking the CISA SSVC decision tree
- turning a CVSS score into a defensible action
- scoring Exploitation, Automatable, Technical Impact and Mission & Well-being
- defining your own asset criticality
- recording an auditable, repeatable vulnerability decision
- explaining how SSVC consumes KEV, EPSS and CVSS
Steps in this lab
- Why a CVSS 9.8 is not a decision
- What SSVC is, and where it comes from
- How SSVC relates to CVSS, KEV and EPSS — inputs vs. the decision
- The four decision points, defined
- The four outcomes the CISA tree produces
- Example 1 — walk an actively-exploited flaw to a decision
- Example 2 — the same CVSS 9.8, a completely different action
- Record the decision — the whole point is that it's auditable
- When NOT to lean on it, the limits, and the way a pro does it