/ 
SSVC-1.00
/ SSVC::CoordinatorTriage

NAME

SSVC::CoordinatorTriage - SSVC Coordinator Triage decision

SYNOPSIS

use SSVC::CoordinatorTriage;

$ssvc = SSVC::CoordinatorTriage->new(
  report_public         => 'no',
  supplier_contacted    => 'yes',
  report_credibility    => 'credible',
  supplier_cardinality  => 'multiple',
  supplier_engagement   => 'unresponsive',
  automatable           => 'yes',
  value_density         => 'concentrated',
  safety_impact         => 'catastrophic',
);

# Get the decision
say $ssvc->decision; # coordinate

# Convert SSVC in JSON in according of SSVC JSON Schema
$json = encode_json($ssvc);

DESCRIPTION

The Coordinator Triage decision helps a coordinator decide whether to decline, track, or actively coordinate a vulnerability report.

https://certcc.github.io/SSVC/howto/triage_decision/

Coordinator Triage

OBJECT-ORIENTED INTERFACE

$ssvc = SSVC::CoordinatorTriage->new(%params)

Creates a new SSVC::CoordinatorTriage instance using the provided decision points.

Parameters / Decision Points:

  • report_public (required)

  • supplier_contacted (required)

  • report_credibility (required)

  • supplier_cardinality (required)

  • supplier_engagement (required)

  • automatable (required), used to compute utility

  • value_density (required), used to compute utility

  • safety_impact (required), used to compute public_safety_impact

  • utility (optional), Computed from automatable and value_density

  • public_safety_impact (optional), Computed from safety_impact

$ssvc->decision

The coordinator triage decision: decline, track or coordinate.

$ssvc->TO_JSON

Helper method for JSON modules (JSON, JSON::PP, JSON::XS, Mojo::JSON, etc).

DECISION POINTS

$ssvc->report_public

Is a viable report of the details of the vulnerability already publicly available?

$ssvc->supplier_contacted

Has the reporter made a good-faith effort to contact the supplier of the vulnerable component using a quality contact method?

$ssvc->report_credibility

Is the report credible?

$ssvc->supplier_cardinality

How many suppliers are responsible for the vulnerable component and its remediation or mitigation plan?

$ssvc->supplier_engagement

Is the supplier responding to the reporter's contact effort and actively participating in the coordination effort?

$ssvc->automatable

Can an attacker reliably automate creating exploitation events for this vulnerability?

$ssvc->value_density

The concentration of value in the target.

$ssvc->safety_impact

The safety impact of the vulnerability.

$ssvc->utility

The usefulness of the exploit to the adversary, computed from automatable and value_density.

$ssvc->public_safety_impact

A coarse-grained representation of impact to public safety, computed from safety_impact.

SEE ALSO

SSVC, SSVC::Base

[Carnegie Mellon University] SSVC: Stakeholder-Specific Vulnerability Categorization (https://certcc.github.io/SSVC/)

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/giterlizzi/perl-SSVC/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-SSVC

git clone https://github.com/giterlizzi/perl-SSVC.git

AUTHOR

  • Giuseppe Di Terlizzi <gdt@cpan.org>

LICENSE AND COPYRIGHT

This software is copyright (c) 2025-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.