/ 
SSVC-1.00
/ SSVC::Supplier

NAME

SSVC::Supplier - SSVC Supplier decision (patch development priority)

SYNOPSIS

use SSVC::Supplier;

$ssvc = SSVC::Supplier->new(
  exploitation      => 'active',
  automatable       => 'yes',
  value_density     => 'concentrated',
  technical_impact  => 'total',
  safety_impact     => 'catastrophic',
);

# Get the decision
say $ssvc->decision; # immediate

# Get the decision point value
say $ssvc->utility; # super_effective

# Convert SSVC in JSON in according of SSVC JSON Schema
$json = encode_json($ssvc);

DESCRIPTION

The Supplier decision helps a supplier (e.g. a software vendor) decide the priority with which to develop and release a patch, or other remediation, for a vulnerability.

https://certcc.github.io/SSVC/howto/supplier_tree/

Supplier

OBJECT-ORIENTED INTERFACE

$ssvc = SSVC::Supplier->new(%params)

Creates a new SSVC::Supplier instance using the provided decision points.

Parameters / Decision Points:

  • exploitation (required)

  • automatable (required), used to compute utility

  • value_density (required), used to compute utility

  • technical_impact (required)

  • safety_impact (required), used to compute public_safety_impact

  • utility (optional), Computed from automatable and value_density

  • public_safety_impact (optional), Computed from safety_impact

$ssvc->decision

The supplier patch-development priority decision: defer, scheduled, out_of_cycle or immediate.

$ssvc->TO_JSON

Helper method for JSON modules (JSON, JSON::PP, JSON::XS, Mojo::JSON, etc).

DECISION POINTS

$ssvc->exploitation

The present state of exploitation of the vulnerability.

$ssvc->automatable

Can an attacker reliably automate creating exploitation events for this vulnerability?

$ssvc->value_density

The concentration of value in the target.

$ssvc->technical_impact

The technical impact of the vulnerability.

$ssvc->safety_impact

The safety impact of the vulnerability.

$ssvc->utility

The usefulness of the exploit to the adversary, computed from automatable and value_density.

$ssvc->public_safety_impact

A coarse-grained representation of impact to public safety, computed from safety_impact.

SEE ALSO

SSVC, SSVC::Base

[Carnegie Mellon University] SSVC: Stakeholder-Specific Vulnerability Categorization (https://certcc.github.io/SSVC/)

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/giterlizzi/perl-SSVC/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-SSVC

git clone https://github.com/giterlizzi/perl-SSVC.git

AUTHOR

  • Giuseppe Di Terlizzi <gdt@cpan.org>

LICENSE AND COPYRIGHT

This software is copyright (c) 2025-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.