Automating SSVC: A Worst-Case Scenario Approach for Evaluating Human Impact of Vulnerabilities

Abstract

The number of cybersecurity vulnerabilities continues to rise, which exposes many organizations to critical risk. To address this issue, we aim to automate vulnerability triage by a Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree for deployers. A challenge is that the decision point of Human Impact (HI), which comprises the impact on safety and mission, depends on both organizational context and vulnerability characteristics, making its automated evaluation difficult. We therefore propose a method that automatically determines HI by combining the pre-assessed worst-case impact with the technical impact of a vulnerability. Specifically, in the preparatory phase, we pre-assess the worst-case impact on safety and mission for each CIA triad (Confidentiality, Integrity, and Availability). Then, when a new vulnerability is discovered during the operational phase, the proposed method adjusts the worst-case impact by considering the level of the vulnerability's technical impact to derive the actual HI. The results of experiments using large language models indicates that the proposed method can automatically evaluate HI at near-expert levels. We also discuss the industrial applicability of the proposed method, including its integration with ticketing systems.