If you work anywhere near vulnerability management, you've run into the CVSS problem: a single severity number that tells you almost nothing about what to actually do. CVSS was never designed to be a triage tool, and treating it like one is how organizations end up "patching everything" or, worse, patching nothing because everything looks equally urgent.

SSVC (Stakeholder-Specific Vulnerability Categorization), developed by Carnegie Mellon's SEI (CERT/CC) and later adapted by CISA into its own decision tree, takes a different approach: instead of a score, it's a decision tree. You feed in a handful of factors specific to your role - exploitation status and technical impact for some methodologies, safety and market-share considerations for others - and it hands you back an actual decision: track it, act on it, attend to it now. Which factors matter, and what decision comes out, depends on who you are in the vulnerability management chain - a vendor, a deployer, a coordinator, a finder - because a coordinator publishing an advisory and a deployer patching a fleet of servers are answering completely different questions with completely different inputs.