Organizations using frameworks similar to SSVC

[sei-renae]

This thread is to make note of organizations that are prioritizing risk in a fashion similar to SSVC.

[sei-renae]

JFrog Security

JFrog’s Security Research and Threat Intelligence teams continuously analyze both new and existing CVEs to assess their real-world exploitability and impact. This analysis results in a JFrog Research Severity Score, which provides deeper insights into each CVE, including:

• Exploitability analysis – How likely is the vulnerability to be weaponized?
• Real-world attack data – Has this CVE been used in documented cyberattacks?
• Impact assessment – What is the potential damage if exploited?
• Severity refinement – Adjustments based on deeper technical evaluation, beyond just the CVSS score.

[sei-renae]

Snyk

Snyk’s Risk Score ingests a wide range of factors — exploit reachability, exploit maturity, business impact, EPSS, CVSS, transitive depth, and social trends — to rank vulnerabilities based on real-world risk.

[sei-renae]

Veracode

Veracode is designed to streamline vulnerability remediation, helping teams fix security issues quickly and efficiently. The Fix-First Analyzer uses data-driven prioritization, evaluating factors such as business impact, risk tolerance, and severity. This enables security and development teams to focus on the most critical vulnerabilities first.

See also: https://community.veracode.com/s/article/How-to-Approach-Remediation-What-to-Fix-First

[sei-renae]

CAST Highlight
Uses CISA's KEV for prioritization and remediation timelines.

[sei-renae]

Sonatype Vulnerability Scanner

Sonatype prioritizes real risk, not just CVSS scores - using reachability, breaking changes, and upgrade availability data to provide accurate findings.

See also: https://www.sonatype.com/solutions/vulnerability-management-tools

Sonatype Lifecycle identifies security vulnerabilities and provides actionable remediation guidance with risk-based prioritization based on severity and business impact, enabling teams to address issues proactively without slowing down innovation.

[ahouseholder]

Tenable VPR has some metrics that intersect with ideas in both CVSS and SSVC.

https://docs.tenable.com/vulnerability-management/Content/Explore/Findings/RiskMetrics.htm