PATCHTRIAGEPatch decision workspace
Open workspace →
Evidence-informed deployment decisions

Patch what matters first.

Turn vulnerability evidence and your system context into a clear patching priority — with a decision path you can explain.

Open workspace →
Why this patch first?auditable signal path
01 / FINDScanner evidenceCVE · package · fixed version
→
02 / THREATExploitation stateActive · Public PoC · None · EPSS watch signal
→
03 / STAKEHOLDERSSVC factorsExposure · Automatable · Human impact
Upgrade spring-beans on web-frontend
Active · Open · Automatable · High human impact → Immediate
Immediate
CERT/CC SSVC · Deployer model

Severity informs. Your environment decides.

Four SSVC factors connect threat evidence to the impact on your system.

SSVC · EExploitationWhat are attackers doing?Active (CISA KEV) · Public PoC · None
SSVC · EXPSystem exposureHow reachable is this system?Open · Controlled · Small
SSVC · AAutomatableCan exploitation be automated?Yes · No · reviewed per vulnerability
SSVC · HIHuman impactWhat happens if exploitation succeeds?Low · Medium · High · Very high, from mission + safety

Add a target

Name your system. Add evidence after saving.
Patch priority contextCERT/CC SSVC
0 of 3 answered
What are these three questions?
They are the official SSVC decision points that describe your deployment, not the vulnerability. They are categories, not a numeric risk score. Leave one on Not assessed and PatchTriage stores it as missing, applies the conservative CERT/CC fallback shown under the question, and flags the decision for confirmation. Session data is isolated and expires from the server after six hours. Official CERT/CC SSVC Deployer model and definitions ↗
Derived · Human Impact HI 2.0.2 — Mission + safety determine Human Impact. Exploitation and Automatable belong to the vulnerability rather than the system and are evaluated per finding.
Optional context · CISA BOD 26-04 policy and supporting evidence
CISA BOD 26-04 policy separate from SSVC Separate decision table (cisa:DT_BOD2604:1.0.0) that never changes SSVC; binding only for US federal civilian systems. Publicly Exposed is CISA's question, not SSVC System Exposure; unassessed, it stays unresolved unless Internet exposed is Yes.
Supporting context evidence PatchTriage fields, not SSVC decision points: they never override the three answers above, are recorded with the decision, and are used as a fallback when System Exposure is left unassessed.
You can leave answers unassessed. Conservative defaults stay flagged until you confirm them.

Import a repository

PatchTriage fetches a GitHub SPDX SBOM without cloning or executing repository code. Repository access follows the GitHub credentials configured for this deployment.

Import an organization

Every recently pushed public repository of the account becomes a target with its GitHub Dependency Graph SBOM attached — the same no-clone, no-execution path as a single repository import. Forks and archived repositories are skipped. Each target starts with the official conservative SSVC defaults; review its context before trusting the decision.