Reassessing 50k Vulnerabilities: Insights from SSVC Evaluations in Japan's Largest Telco

The talk looks at how a major Japanese telecom carrier, serving more than 13 million customers, struggles to triage a steadily growing number of published vulnerabilities across hundreds of services and both open and closed networks. The speaker explains that tuning CVSS scores with temporal and environmental metrics did not change outcomes enough to reduce the workload, because CVSS measures severity but offers no guidance on what action to take.

The team then adopted Stakeholder-Specific Vulnerability Categorization, a decision-tree framework from Carnegie Mellon University. Their criteria rate exploitation status, exposure from closed management systems up to internet-facing servers, utility based on automatability and value density, and human impact on services. Each combination maps to an action such as immediate, out of cycle, scheduled or deferred. Worked examples show a public web service with a 9.8 CVSS score landing in the immediate group, while a closed-network service with active exploitation landed in out of cycle.

To test the method, the team reassessed about 50,000 vulnerabilities pulled from their management database, a task that two people completed within days. Only about 8% fell into the immediate category. Nearly all public-facing items were in the urgent tiers, while closed-network items were mostly scheduled or deferred. Some low-severity findings still reached immediate when active exploitation and open exposure outweighed the base score. The main takeaway is that pairing exploitation status and exposure with business impact can produce a workable response queue. Choosing the important parameters and automating system classification remain open work.