Add SSVC doc explaining "human-scale bottleneck" idea by ahouseholder · Pull Request #1087 · CERTCC/SSVC

ahouseholder · 2026-03-12T20:07:41Z

resolves #1033

This pull request adds a new documentation file explaining the role of SSVC (Stakeholder-Specific Vulnerability Categorization) as a human-scale bottleneck in automated vulnerability response processes. The document clarifies how SSVC condenses complex, automated data into manageable decision points, and emphasizes the importance of human oversight in policy definition and governance.

Key additions to documentation:

Introduced a comprehensive explanation of SSVC as a human-scale bottleneck, ensuring transparency and accountability in automated vulnerability response workflows.
Detailed the characteristics of SSVC decision points, including their ordinal, orthogonal, and "chunky" nature, which keeps the decision table compact and understandable.
Explained how the SSVC decision table codifies policy as code, mapping technical inputs to business-aligned outcomes, and outlined criteria for effective table design.
Provided guidance on governance and policy refinement, describing how SSVC enables straightforward modification and clear accountability for risk owners.
Clarified that SSVC is not a process bottleneck—automation can occur throughout, with humans responsible for designing and governing the decision framework rather than reviewing every decision.

Copilot

Pull request overview

Adds a new How-To documentation page explaining SSVC’s role as a “human-scale bottleneck” between large-scale automated vulnerability data collection/analysis and large-scale operational response, emphasizing policy governance and accountability.

Changes:

Added a new documentation page describing SSVC decision points as a compact, human-governable interface in automated workflows.
Documented design characteristics (ordinal/orthogonal/chunky) and how decision tables encode organizational policy and governance refinement.

You can also share your feedback on Copilot code review. Take the survey.

docs/howto/ssvc-human-scale-bottleneck.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

sei-renae · 2026-03-18T21:10:43Z

docs/howto/ssvc-human-scale-bottleneck.md

@@ -0,0 +1,116 @@
+# **SSVC: The Human-Scale Bottleneck in Automated Vulnerability Response**
+
+As vulnerability response processes become increasingly saturated with automation—from AI-driven data collection to sophisticated analysis—the **Stakeholder-Specific Vulnerability Categorization (SSVC)** model is intentionally designed to serve as a crucial, human-scale bottleneck. This approach ensures that while the process is efficient and automated, the core decision-making remains transparent, accountable, and aligned with organizational risk appetite, providing a necessary bridge between technical data and business policy.


Can you be more precise and less "big ideas without backing"

sei-renae · 2026-03-18T21:13:01Z

Some high level notes:

This does not read like a "how to guide" per the diataxis framework. It seems more akin to an "explanation."
I don't know who the audience is
H2 "The Decision Table: Policy as Code" lost my interest as a reader, if I'm expecting to learn about a human bottleneck

sei-renae · 2026-03-18T21:15:45Z

docs/howto/ssvc-human-scale-bottleneck.md

+gov -->|refines| dc
+```
+
+On the input side, [Data Mapping](bootstrap/collect.md) funnels large-scale 


Suggest making it explicit that "Decision Model" and SSVC are analogous here whereas Data Mapping and Use & Respond are related but technically out of scope. Or at least, that's how this reads, if I were to click the hyperlinks and read more.

sei-renae · 2026-03-18T21:17:28Z

docs/howto/ssvc-human-scale-bottleneck.md

+
+## **Condensing Complexity into Human-Scale Decisions**
+
+The initial stages of vulnerability response—[data collection and mapping](bootstrap/collect.md)—often involve vast amounts of information, advanced data sharing formats, and powerful analytical tools, increasingly including AI agents and Large Language Models (LLMs). SSVC's core function is to condense this extensive, complex dataset into a small, manageable set of **decision points**.


Suggest hyperlinking decision points and being more specific about "advanced data sharing formats" and "powerful analytical tools."

sei-renae · 2026-03-18T21:20:34Z

docs/howto/ssvc-human-scale-bottleneck.md

+
+## **The Decision Table: Policy as Code**
+
+By defining a set of orthogonal, ordered decision points, SSVC induces a **partial order** on the entire input space (the Cartesian product of all decision point values). The resulting ordered set of input combinations is then mapped, via a **decision table**, onto a predefined **outcome set** of ordered outcomes.


Suggest hyperlinking decision table and outcome set

Suggest italicizing instead of bolding "partial order", or linking to its wikipedia page. I don't think we can expect newbies to be familiar with granularities of order theory.

sei-renae · 2026-03-18T21:38:55Z

docs/howto/ssvc-human-scale-bottleneck.md

+| **Chunky Values** | Limiting values per input (2-5) prevents exponential growth of the table size ($3 \times 3 \times 3 = 27$ rows; $4 \times 3 \times 3 \times 3 = 108$ rows).                                                         |
+| **Understandability** | Decision points must be understandable to non-technical risk owners, focusing on business impact rather than technical specifics (e.g., "Criticality of Affected System" instead of "Buffer Overflow vs. SQL Injection"). |
+
+## **The Role of the Human in a Machine-Driven World**


This should be the beginning of the document.

sei-renae · 2026-03-18T21:39:46Z

docs/howto/ssvc-human-scale-bottleneck.md

+The concept of SSVC as a human-scale bottleneck means that the complexity of the automated threat landscape is filtered through a framework **designed by humans, for humans, and understood by humans**.
+
+**1\. Accountability and Risk Alignment:**  
+The decision table provides an explicit, unambiguous link between technical vulnerability characteristics and organizational risk appetite. This structure facilitates crucial conversations between technical implementers (responsible for patching) and risk owners (CISO, IT management, senior management), transferring responsibility from technical staff making proxy judgments to risk owners defining explicit policy.


Suggest: disambiguate "technical staff" and "risk owners"

sei-renae · 2026-03-18T21:40:39Z

docs/howto/ssvc-human-scale-bottleneck.md

+- **With SSVC:** Decisions are explained using comprehensible terms: "We are responding immediately because this has **High Technical Impact** and affects a **Critical Central Server**. This aligns with our established policy." The risk owner can also explain this policy up to their management.
+
+**2\. Governance and Policy Refinement:**  
+The SSVC model is designed for straightforward modification, enabling policy owners to easily adapt their response posture when needed. Changes are typically managed through predictable steps. This process ensures that when a risk owner desires a change, the modification to the policy (the decision table) can be clearly executed and understood.


This seems like a lot of words to say "transparency"

sei-renae · 2026-03-18T21:42:30Z

docs/howto/ssvc-human-scale-bottleneck.md

+**2\. Governance and Policy Refinement:**  
+The SSVC model is designed for straightforward modification, enabling policy owners to easily adapt their response posture when needed. Changes are typically managed through predictable steps. This process ensures that when a risk owner desires a change, the modification to the policy (the decision table) can be clearly executed and understood.
+
+The SSVC governance loop—described in detail in the [Prepare](bootstrap/prepare.md#establish-governance) step of the Getting Started guide—is what makes this refinement practical. Because the decision table is small and explicit, conversations about policy changes stay grounded:


To me, "loop" implies a circuit, and the linked diagram is not a circuit.

sei-renae · 2026-03-18T21:44:43Z

docs/howto/ssvc-human-scale-bottleneck.md

+- Does the **decision table** still reflect how the organization wants to make decisions?
+    - Have there been cases where the table led to a decision that was later regretted?
+    - Are there new constraints or requirements not yet captured?
+- Is the **[data mapping](bootstrap/collect.md)** still appropriate—are the right data sources being used to assign values to decision points?


Suggest changing this from bootstrap/collect.md to bootstrap/prepare.md

sei-renae · 2026-03-18T21:45:14Z

docs/howto/ssvc-human-scale-bottleneck.md

+    - Are there new constraints or requirements not yet captured?
+- Is the **[data mapping](bootstrap/collect.md)** still appropriate—are the right data sources being used to assign values to decision points?
+
+Depending on the review, adjustments can be made to any layer of the model. The impact of those adjustments is predictable:


This is the first mention of model "layer"

sei-renae · 2026-03-18T21:47:27Z

docs/howto/ssvc-human-scale-bottleneck.md

+| **Adding/Reducing Values** | Small, measurable change. Adding a value increases the table size additively (e.g., $3 \times 3 \times 3 = 27$ to $4 \times 3 \times 3 = 36$). |
+| **Adding a Decision Point** | Multiplicative increase in table size (e.g., $3 \times 3 \times 3 = 27$ to $3 \times 3 \times 3 \times 3 = 81$). Requires a more involved policy review. |
+
+Crucially, governance should involve the right stakeholders. Risk owners must be involved in reviewing and adjusting the decision table itself, while vulnerability management and IT security teams are best positioned to review the data mapping and decision point definitions. Operational feedback from [Use & Respond](bootstrap/use.md) provides the empirical basis for identifying where the model needs refinement.


This is contradictory to my understanding of "Use & Respond" per documentation

sei-renae · 2026-03-18T21:47:54Z

docs/howto/ssvc-human-scale-bottleneck.md

+
+Crucially, governance should involve the right stakeholders. Risk owners must be involved in reviewing and adjusting the decision table itself, while vulnerability management and IT security teams are best positioned to review the data mapping and decision point definitions. Operational feedback from [Use & Respond](bootstrap/use.md) provides the empirical basis for identifying where the model needs refinement.
+
+## **SSVC is Not a Process Bottleneck**


This should also go at the beginning of the document.

sei-renae · 2026-03-18T21:48:23Z

docs/howto/ssvc-human-scale-bottleneck.md

+
+Automation can exist throughout the entire response workflow:
+
+- **Input Automation:** AI or LLMs can perform the "reading comprehension test" of analyzing raw vulnerability data and mechanically selecting the correct values for the SSVC decision points. See [Data Mapping](bootstrap/collect.md) for how to connect data sources to decision point values.  


Suggest revising:
"AI, such as an LLM, ..."

sei-renae · 2026-03-18T21:49:13Z

docs/howto/ssvc-human-scale-bottleneck.md

+
+Automation can exist throughout the entire response workflow:
+
+- **Input Automation:** AI or LLMs can perform the "reading comprehension test" of analyzing raw vulnerability data and mechanically selecting the correct values for the SSVC decision points. See [Data Mapping](bootstrap/collect.md) for how to connect data sources to decision point values.  


Again, this should hyperlink to howto/prepare.md

sei-renae · 2026-03-18T21:49:48Z

docs/howto/ssvc-human-scale-bottleneck.md

+- **Input Automation:** AI or LLMs can perform the "reading comprehension test" of analyzing raw vulnerability data and mechanically selecting the correct values for the SSVC decision points. See [Data Mapping](bootstrap/collect.md) for how to connect data sources to decision point values.  
+- **Output Automation:** The prioritized outcome from the SSVC table (e.g., "Immediate") can feed directly into automated patching, ticketing, or software fix development systems. See [Use & Respond](bootstrap/use.md) for how to operationalize SSVC outcomes at scale.
+
+SSVC acts as a fixed, unambiguous interface. The "human scale" element is in the **design and governance** of this interface, ensuring human accountability and understanding of the decision-making logic. The table's fixed structure means there is no ambiguity from a human's understanding standpoint—you know what the output will be based on the defined inputs and policy. It is the locus where technical reality meets organizational policy. The human is in the loop defining the decision space, not necessarily every single decision.


"understanding standpoint" reads weird

sei-renae

See comments in-line and in the Conversation.

resolves #1033: Add SSVC doc explaining "human-scale bottleneck" idea

b27d56e

Copilot AI review requested due to automatic review settings March 12, 2026 20:07

ahouseholder requested review from cgyarbrough, j--- and sei-vsarvepalli as code owners March 12, 2026 20:07

ahouseholder self-assigned this Mar 12, 2026

ahouseholder requested a review from sei-renae March 12, 2026 20:07

Copilot started reviewing on behalf of ahouseholder March 12, 2026 20:08 View session

ahouseholder added the content/semantic Changes to the semantic content of the SSVC documentation label Mar 12, 2026

ahouseholder added this to the 2026-03 milestone Mar 12, 2026

Copilot AI reviewed Mar 12, 2026

View reviewed changes

docs/howto/ssvc-human-scale-bottleneck.md Outdated Show resolved Hide resolved

docs/howto/ssvc-human-scale-bottleneck.md Show resolved Hide resolved

docs/howto/ssvc-human-scale-bottleneck.md Outdated Show resolved Hide resolved

docs/howto/ssvc-human-scale-bottleneck.md Show resolved Hide resolved

ahouseholder and others added 7 commits March 12, 2026 16:13

Apply suggestions from code review

8b48d44

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

add ssvc human scale bottleneck page to nav

304a59b

Merge branch 'fix-1033' of https://github.com/CERTCC/SSVC into fix-1033

702b6a6

markdownlint --fix

b2e7af7

wording

cdc25c2

add diagram and links to other pages

8eac547

refine diagram

5907773

sei-renae reviewed Mar 18, 2026

View reviewed changes

sei-renae requested changes Mar 18, 2026

View reviewed changes

		@@ -0,0 +1,116 @@
		# SSVC: The Human-Scale Bottleneck in Automated Vulnerability Response

		As vulnerability response processes become increasingly saturated with automation—from AI-driven data collection to sophisticated analysis—the Stakeholder-Specific Vulnerability Categorization (SSVC) model is intentionally designed to serve as a crucial, human-scale bottleneck. This approach ensures that while the process is efficient and automated, the core decision-making remains transparent, accountable, and aligned with organizational risk appetite, providing a necessary bridge between technical data and business policy.


		## Condensing Complexity into Human-Scale Decisions

		The initial stages of vulnerability response—[data collection and mapping](bootstrap/collect.md)—often involve vast amounts of information, advanced data sharing formats, and powerful analytical tools, increasingly including AI agents and Large Language Models (LLMs). SSVC's core function is to condense this extensive, complex dataset into a small, manageable set of decision points.


		## The Decision Table: Policy as Code

		By defining a set of orthogonal, ordered decision points, SSVC induces a partial order on the entire input space (the Cartesian product of all decision point values). The resulting ordered set of input combinations is then mapped, via a decision table, onto a predefined outcome set of ordered outcomes.


		Crucially, governance should involve the right stakeholders. Risk owners must be involved in reviewing and adjusting the decision table itself, while vulnerability management and IT security teams are best positioned to review the data mapping and decision point definitions. Operational feedback from [Use & Respond](bootstrap/use.md) provides the empirical basis for identifying where the model needs refinement.

		## SSVC is Not a Process Bottleneck


		Automation can exist throughout the entire response workflow:

		- Input Automation: AI or LLMs can perform the "reading comprehension test" of analyzing raw vulnerability data and mechanically selecting the correct values for the SSVC decision points. See [Data Mapping](bootstrap/collect.md) for how to connect data sources to decision point values.

Conversation

ahouseholder commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sei-renae commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sei-renae left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sei-renae commented Mar 18, 2026 •

edited

Loading