Transform CVSS scores into contextual risk assessments that reflect the actual threat to your specific systems
Example SSCV Vector
SSCV:1.0/OS:C/NE:E/AC:F/EP:A/DL:M/PS:C
A CVSS 10.0 vulnerability might pose minimal risk to an air-gapped system, while a CVSS 6.0 could be critical on an internet-facing server with sensitive data.
Combines CVSS base scores with system-specific security context to calculate real-world risk
Enforces 20% minimum risk, acknowledging that no system is ever completely secure from zero-days and supply chain attacks
Evaluates core security controls and exposure factors that every organization can assess immediately
SSCV v1.0 focuses on essential security factors that every organization can assess, providing immediate value for vulnerability prioritization
Core security controls that reduce vulnerability risk
Amplify risk based on accessibility and data value
Simple & Practical:
SSCV v1.0 focuses on six components every security team can assess. Future versions will add specialized components for advanced use cases like industrial systems and critical infrastructure.
Use the standard CVSS score as your foundation
Evaluate 6 essential security factors specific to your system
OS:C - Current operating system
NE:I - Internal network only
AC:F - Full MFA + RBAC
EP:A - Advanced EDR
DL:M - Mixed (contains PII)
PS:C - Current patchesSSCV formula adjusts risk based on your security posture
CRS = CVSS × Security_Avg × Exposure_Factor × Operational_Avg
With 20% minimum threshold to ensure no vulnerability is ignored
CVSS Score: 10.0
SSCV Vector:
SSCV:1.0/OS:C/NE:E/AC:F/EP:A/DL:C/PS:C
SSCV Result: 8.5 (High)
⚠ External exposure + critical data = high priority despite good controls
CVSS Score: 8.5
SSCV Vector:
SSCV:1.0/OS:L/NE:A/AC:N/EP:N/DL:I/PS:U
SSCV Result: 3.2 (Low)
✓ Air gap + physical security compensate for poor software security
See how organizations are using SSCV to transform their security operations, risk management, and business decisions
Track organizational security posture with aggregated SSCV scores. Create department scorecards, visualize risk heat maps, and measure improvement over time.
Calculate risk-adjusted premiums based on SSCV scores. Demonstrate due diligence, meet policy requirements, and qualify for better rates.
Map SSCV components directly to compliance requirements. Automate evidence collection for PCI DSS, NIST CSF, SOC 2, and other frameworks.
Focus on what matters: a CVSS 6.0 on your payment server can be more critical than a CVSS 10.0 on an isolated dev system.
Standardize security due diligence. Quickly assess acquisition targets and estimate remediation costs based on SSCV profiles.
Integrate SSCV with vulnerability scanners, SIEM platforms, and asset management systems via standardized APIs and data formats.
Assess all 6 v1.0 components immediately. Future versions will add specialized components for advanced use cases.
Focus on highest CVSS vulnerabilities first. Calculate SSCV for critical systems.
Integrate with existing tools. Auto-detect components where possible.
Want to explore more implementation ideas and technical details?
Download Complete Implementation GuideCalculate contextual risk scores for your vulnerabilities in seconds
Our AI assistant can help you understand the framework, calculate risk scores, and answer your security assessment questions.
Powered by ChatGPT • Available 24/7