Evidence-informed deployment decisions

Patch what matters first.

Combine global threat evidence with your system exposure, mission impact, and safety context to make one defensible SSVC deployment decision — without letting AI invent a score.

Why this patch first?auditable signal path

01 / FINDScanner evidenceCVE · package · fixed version

→

02 / THREATExploitation stateActive · Public PoC · None · EPSS watch signal

→

03 / STAKEHOLDERSSVC factorsExposure · Automatable · Human impact

Upgrade spring-beans on web-frontend
Active · Open · Automatable · High human impact → Immediate

Immediate

CERT/CC SSVC · Deployer model

Severity informs. Your environment decides.

KEV and PoC evidence establish what attackers are doing. SSVC combines that state with how your system is deployed and what failure means to your organization.

SSVC · EExploitationWhat are attackers doing?Active (CISA KEV) · Public PoC · None

SSVC · EXPSystem exposureHow reachable is this system?Open · Controlled · Small

SSVC · AAutomatableCan exploitation be automated?Yes · No · reviewed per vulnerability

SSVC · HIHuman impactWhat happens if exploitation succeeds?Low · Medium · High · Very high, from mission + safety

Targets

asset context

Add a target

Patch priority contextCERT/CC SSVC

0 of 3 answered

What are these three questions?

They are the official SSVC decision points that describe your deployment, not the vulnerability. They are categories, not a numeric risk score. Leave one on Not assessed and PatchTriage stores it as missing, applies the conservative CERT/CC fallback shown under the question, and flags the decision for confirmation. Session data is isolated and expires from the server after six hours. Official CERT/CC SSVC Deployer model and definitions ↗

1System ExposureEXP 1.0.1 How reachable is this system from where an attacker stands? 2Mission ImpactMI 2.0.0 If this system fails, what happens to the work your organization must keep doing? A MEF is a Mission Essential Function. 3Safety ImpactSI 2.0.1 What is the worst credible harm to people — physical, operational, environmental, financial or psychological?

Derived · Human Impact HI 2.0.2 — Questions 2 and 3 combine through the published Human Impact table — PatchTriage never adds them up. The two remaining decision points, Exploitation and Automatable, belong to the vulnerability rather than the system, so they come from CISA KEV and Vulnrichment per finding.

Advanced context evidence

Supporting evidence. These are PatchTriage fields, not SSVC decision points: they never override the three answers above, but they are recorded with the decision and used as a fallback when System Exposure is left unassessed. Criticality

Internet exposedCode reachable

Runtime observed Context evidence sources

Answer what you know. Anything left on “Not assessed” still produces a decision — it just carries the conservative fallback and stays flagged for confirmation, and you can revisit it later with Review context.

Patch decisions

Decision engine SSVC deterministic

ImmediateAct now · example local SLA 3 days

Out-of-CycleNext opportunity · example SLA 14 days

ScheduledNormal maintenance · example SLA 30 days

DeferMonitor · example review at 90 days

Decision, not detection

See why the same CVE needs a different action here.

Load the bundled evidence. PatchTriage applies the official SSVC Deployer path, shows every inferred input and confidence level, then groups findings into package-level actions.

GLOBAL SIGNALSKEV · EPSS · CVSSwhat attackers can do

SSVC / YOUR SYSTEMImmediatewhat your team should do now

Patch what matters first.

Severity informs. Your environment decides.

Patch decisions

See why the same CVE needs a different action here.

Import a repository

Import an organization