SSVC - Perl extension for SSVC (Stakeholder-Specific Vulnerability Categorization)

Synopsis

use SSVC;

$ssvc = SSVC->new(
  cisa => {
    exploitation             => 'active',
    automatable              => 'yes',
    technical_impact         => 'partial',
    mission_prevalence       => 'minimal',
    public_well_being_impact => 'irreversible',
  }
);

# Get the decision
say $ssvc->decision; # act

# Parse SSVC vector string (only SSVC::CISA implements a vector string grammar)
$ssvc = SSVC::CISA->from_vector_string('SSVCv2/E:A/A:Y/T:P/P:M/B:I/M:H/D:C/2025-01-01T00:00:00');

# Convert the SSVC object in "vector string"
say $ssvc; # SSVCv2/E:A/A:Y/T:P/P:M/B:I/M:H/D:C/2025-01-01T00:00:00

# Get the decision point value
say $ssvc->public_well_being_impact; # irreversible

# Convert SSVC in JSON in according of SSVC JSON Schema
$json = encode_json($ssvc);

Supported methodoligies

| Methodology Key | Name | Class | |---------------------------|---------------------------------|---------------------------------| | cisa | CISA Coordinator | SSVC::CISA | | cisa_bod_26_04 | CISA BOD 26-04 Response Model | SSVC::CISA::BOD2604 | | coordinator_publication | Publication Decision | SSVC::CoordinatorPublication | | coordinator_triage | Coordinator Triage | SSVC::CoordinatorTriage | | deployer | Deployer Decision Model | SSVC::Deployer | | supplier | Supplier Decision Model | SSVC::Supplier |

Install

Using Makefile.PL:

To install SSVC distribution, run the following commands.

perl Makefile.PL
make
make test
make install

Using App::cpanminus:

cpanm SSVC

Documentation

• perldoc SSVC
• https://metacpan.org/release/SSVC
• [Carnegie Mellon University] SSVC: Stakeholder-Specific Vulnerability Categorization (https://certcc.github.io/SSVC/)
• [CISA] Stakeholder-Specific Vulnerability Categorization Guide (https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf)

Copyright

• Copyright 2025-2026 © Giuseppe Di Terlizzi