SSVC Copilot: um Assistente de Priorização de Vulnerabilidades Baseado no Arcabouço SSVC
Resumo
O elevado número de vulnerabilidades identificadas em sistemas torna a priorização de correções um problema relevante. Embora métricas como CVSS e EPSS sejam amplamente utilizadas, elas não consideram o contexto operacional e organizacional. Neste trabalho, apresentamos o SSVC Copilot, um assistente de priorização de vulnerabilidades baseado no arcabouço Stakeholder-Specific Vulnerability Categorization (SSVC). A solução utiliza agentes especializados para inferir pontos de decisão do SSVC a partir de múltiplas fontes de Cyber Threat Intelligence, combinando automação e interação humano–IA. A avaliação com 144.163 CVEs publicados entre 2016 e 2026 demonstrou que o SSVC Copilot alcançou taxas de concordância de até 97,18% com o CISA Vulnrichment. Por fim, os resultados indicam que o contexto fornecido pelo humano permite à IA incorporar sua avaliação de risco e sugerir decisões futuras alinhadas.Referências
Aqua Security (2024). Trivy: Comprehensive vulnerability scanner for containers and other artifacts. [link]. Accessed: 2026-04-13.
CERT Coordination Center (2024a). SSVC Decision Point: Exploitation. [link]. Accessed: 2026-05-08.
CERT Coordination Center (2024b). SSVC Decision Point: Human Impact. [link]. Accessed: 2026-05-08.
CERT Coordination Center (2025). EPSS probability as input to exploitation. SSVC: Stakeholder-Specific Vulnerability Categorization. Acesso em: 31 jul. 2026.
CERT Coordination Center (2026). Worked Example. [link]. SSVC: Stakeholder-Specific Vulnerability Categorization. Acesso em: 21 maio 2026.
CISA (2023). Stakeholder-specific vulnerability categorization (ssvc). [link]. Accessed: 2026-04-13.
CISA) (2024). Known Exploited Vulnerabilities Catalog. Accessed: 2026-04-15.
CISA (2026). Vulnrichment project. [link] hment. Accessed: 2026-04-29.
Cohen, D., Te’eni, D., Yahav, I., Zagalsky, A., Schwartz, D., Silverman, G., Mann, Y., Elalouf, A., and Makowski, J. (2025). Human–ai enhancement of cyber threat intelligence. International Journal of Information Security, 24(2):99.
FIRST (2024). Forum of incident response and security teams. common vulnerability scoring system (cvss). [link]. Accessed: 2026-04-13.
Foundjem, A., Nganyewou Tidjon, L., Da Silva, L., and Khomh, F. (2026). Multi-agent ai framework for threat mitigation and resilience in machine learning systems. ACM Trans. Softw. Eng. Methodol. Just Accepted.
Gustavsson, P. M., Kollberg, M., Nadjafi, M., Wiktorin, J., and Persson, V. (2025). The cyber due diligence object model (cddom): A structured approach to cybersecurity risk, interoperability, and regulatory alignment. SSRN Electronic Journal. Preprint, not peer reviewed.
Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., and Roytman, M. (2021). Exploit prediction scoring system (epss). Digital Threats, 2(3).
Janloy, K., Wuttidittachotti, P., Wannapiroon, P., and Kaewduangta, P. (2025). Agentic ai-driven and human-centered cyber immune platforms for cyber threat intelligence verification under pdpa regulations. In 2025 5th International Conference on Educational Communications and Technology (ICTAECT), pages 1–7.
Kshetri, N. and Voas, J. (2025). Agentic artificial intelligence for cyber threat management. Computer, 58(5):86–90.
Liu, X., Liang, J., Yan, Q., Jang, J., Mao, S., Ye, M., Jia, J., and Xi, Z. (2025). Cylens: Towards reinventing cyber threat intelligence in the paradigm of agentic large language models. arXiv preprint arXiv:2502.20791.
Mavroeidis, V., Hohimer, R., Casey, T., and Jesang, A. (2021). Threat actor type inference and characterization within cyber threat intelligence. In 2021 13th International Conference on Cyber Conflict (CyCon), pages 327–352.
MITRE Corporation (2026). Common weakness enumeration (cwe). [link]. Accessed: 2026-04-29.
NIST (2021). CVE-2021-44228 Detail. [link]. Accessed: 2026-04-15.
NIST (2024). National Institute of Standards and Technology. National Vulnerability Database (NVD). Accessed: 2026-04-15.
Offensive Security (2024). Exploit Database. Accessed: 2026-04-15.
Rapid7 (2024). Metasploit Framework. Accessed: 2026-04-15.
Saccone, F., Manzi, A., Di Sorbo, A., Costante, E., and Visaggio, C. A. (2025). Design and implementation of a multi-agent threat intelligence assistant based on generative ai. In 2025 IEEE International Conference on Big Data (BigData), pages 6883–6888.
Sadlek, L. (2020). Threat management based on information about vulnerabilities. Master’s thesis, Faculty of Informatics - Masaryk University, Brno, Czech Republic.
Snyk Ltd. (2024). Snyk: Developer security platform. [link]. Accessed: 2026-04-13.
Spyros, A., Koritsas, I., Papoutsis, A., Panagiotou, P., Chatzakou, D., Kavallieros, D., Tsikrika, T., Vrochidis, S., and Kompatsiaris, I. (2025). Ai-based holistic framework for cyber threat intelligence management. IEEE Access, 13:20820–20846.
Tsuji, D., Ueki, Y., Kawaguchi, N., Kakuta, T., and Nakakoji, H. (2026). Automating ssvc: A worst-case scenario approach for evaluating human impact of vulnerabilities. IEICE Communications Express, pages 1–4.
CERT Coordination Center (2024a). SSVC Decision Point: Exploitation. [link]. Accessed: 2026-05-08.
CERT Coordination Center (2024b). SSVC Decision Point: Human Impact. [link]. Accessed: 2026-05-08.
CERT Coordination Center (2025). EPSS probability as input to exploitation. SSVC: Stakeholder-Specific Vulnerability Categorization. Acesso em: 31 jul. 2026.
CERT Coordination Center (2026). Worked Example. [link]. SSVC: Stakeholder-Specific Vulnerability Categorization. Acesso em: 21 maio 2026.
CISA (2023). Stakeholder-specific vulnerability categorization (ssvc). [link]. Accessed: 2026-04-13.
CISA) (2024). Known Exploited Vulnerabilities Catalog. Accessed: 2026-04-15.
CISA (2026). Vulnrichment project. [link] hment. Accessed: 2026-04-29.
Cohen, D., Te’eni, D., Yahav, I., Zagalsky, A., Schwartz, D., Silverman, G., Mann, Y., Elalouf, A., and Makowski, J. (2025). Human–ai enhancement of cyber threat intelligence. International Journal of Information Security, 24(2):99.
FIRST (2024). Forum of incident response and security teams. common vulnerability scoring system (cvss). [link]. Accessed: 2026-04-13.
Foundjem, A., Nganyewou Tidjon, L., Da Silva, L., and Khomh, F. (2026). Multi-agent ai framework for threat mitigation and resilience in machine learning systems. ACM Trans. Softw. Eng. Methodol. Just Accepted.
Gustavsson, P. M., Kollberg, M., Nadjafi, M., Wiktorin, J., and Persson, V. (2025). The cyber due diligence object model (cddom): A structured approach to cybersecurity risk, interoperability, and regulatory alignment. SSRN Electronic Journal. Preprint, not peer reviewed.
Jacobs, J., Romanosky, S., Edwards, B., Adjerid, I., and Roytman, M. (2021). Exploit prediction scoring system (epss). Digital Threats, 2(3).
Janloy, K., Wuttidittachotti, P., Wannapiroon, P., and Kaewduangta, P. (2025). Agentic ai-driven and human-centered cyber immune platforms for cyber threat intelligence verification under pdpa regulations. In 2025 5th International Conference on Educational Communications and Technology (ICTAECT), pages 1–7.
Kshetri, N. and Voas, J. (2025). Agentic artificial intelligence for cyber threat management. Computer, 58(5):86–90.
Liu, X., Liang, J., Yan, Q., Jang, J., Mao, S., Ye, M., Jia, J., and Xi, Z. (2025). Cylens: Towards reinventing cyber threat intelligence in the paradigm of agentic large language models. arXiv preprint arXiv:2502.20791.
Mavroeidis, V., Hohimer, R., Casey, T., and Jesang, A. (2021). Threat actor type inference and characterization within cyber threat intelligence. In 2021 13th International Conference on Cyber Conflict (CyCon), pages 327–352.
MITRE Corporation (2026). Common weakness enumeration (cwe). [link]. Accessed: 2026-04-29.
NIST (2021). CVE-2021-44228 Detail. [link]. Accessed: 2026-04-15.
NIST (2024). National Institute of Standards and Technology. National Vulnerability Database (NVD). Accessed: 2026-04-15.
Offensive Security (2024). Exploit Database. Accessed: 2026-04-15.
Rapid7 (2024). Metasploit Framework. Accessed: 2026-04-15.
Saccone, F., Manzi, A., Di Sorbo, A., Costante, E., and Visaggio, C. A. (2025). Design and implementation of a multi-agent threat intelligence assistant based on generative ai. In 2025 IEEE International Conference on Big Data (BigData), pages 6883–6888.
Sadlek, L. (2020). Threat management based on information about vulnerabilities. Master’s thesis, Faculty of Informatics - Masaryk University, Brno, Czech Republic.
Snyk Ltd. (2024). Snyk: Developer security platform. [link]. Accessed: 2026-04-13.
Spyros, A., Koritsas, I., Papoutsis, A., Panagiotou, P., Chatzakou, D., Kavallieros, D., Tsikrika, T., Vrochidis, S., and Kompatsiaris, I. (2025). Ai-based holistic framework for cyber threat intelligence management. IEEE Access, 13:20820–20846.
Tsuji, D., Ueki, Y., Kawaguchi, N., Kakuta, T., and Nakakoji, H. (2026). Automating ssvc: A worst-case scenario approach for evaluating human impact of vulnerabilities. IEICE Communications Express, pages 1–4.
Publicado
01/09/2026
Como Citar
FILHO, Jan; ALBUQUERQUE, Arthur; FALCÃO, Eduardo; BRITO, Andrey.
SSVC Copilot: um Assistente de Priorização de Vulnerabilidades Baseado no Arcabouço SSVC. In: SIMPÓSIO BRASILEIRO DE CIBERSEGURANÇA (SBSEG), 26. , 2026, Armação dos Búzios/RJ.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2026
.
p. 1089-1104.
DOI: https://doi.org/10.5753/sbseg.2026.26974.
