Verification · Threat modeling · Risk prioritization
Decision trees
SSVC decisions from exploitation, exposure and impact.
How to build it
- Score each confirmed weakness on exploitation, exposure and impact.
- Map each combination to a fixed decision such as act now, act soon, track or defer.
- Store the decision tree in a file the team reviews each quarter.
Signals in a repository
- An SSVC decision table or decision tree file in the repository.
- Triage labels such as act-now or defer on security issues.
- A reference to SSVC in the security policy.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.