List of projects that expose SSVC as a feature of their project

[chrisdlangton]

I searched the site, issues, and Wiki for any mention of there being a list of community projects or vendor products that expose SSVC decision outcomes as a feature of their software - or libraries beside the official reference code that help these projects and products integrate SSVC.

[ahouseholder]

Hi @chrisdlangton, we try to capture "sightings" in this thread that includes media, blogs, etc. But it's probably closer to what you're asking about than anything else.

Two notable places to start:

• CISA just announced a Vulnrichment project https://www.securityweek.com/cisa-announces-cve-enrichment-project-vulnrichment/ that adds SSVC data to CVE records
• Risk Based Prioritization is probably the most thorough description of an implementation of SSVC in an operational context that I've seen. https://riskbasedprioritization.github.io/

[chrisdlangton]

@ahouseholder I was asking because I'm maintaining python and typescript implementations following both FIRST and CISA methodologies - and curiosity about where these can be mentioned as ways to use SSVC in products/projects

As I asked about this, and considering I'm the first to publish them on PyPI.org and NPM.org repositories - that the list would basically be my two so far anyway?