Before you quote a patch statistic to a board, confirm its source, date, scope, clock, definition of done, statistic type and sample. If any of those are unknown, say so on the slide or leave the number out. A smaller claim you can defend beats a striking one you cannot.
The checklist
- Primary source. Can you open the original report, not a news summary of it? Summaries drop caveats.
- Date and period. What year does the data cover, and is it still current?
- Scope. Which vulnerabilities, products or sectors are included?
- Clock. Where does measurement start and stop?
- Definition of done. Fixed, mitigated or closed?
- Statistic. Mean, median, half-life or percent by a deadline?
- Sample. Whose data, how large, how selected?
- Exclusions. Were outliers or unfixed items removed?
- Independence. Does the author sell something the statistic supports?
- Reproducibility. Could someone else check it, or is it a black box?
Worked example: two numbers, two answers
Mandiant reported an average time-to-exploit of five days for its 2023 sample, with 15 outliers excluded, and 47 days when they are included (Mandiant). A slide that says "exploited in five days" fails checks 3, 8 and 6. A slide that says "In one vendor's 2023 sample of exploited flaws, the average was five days after removing outliers" passes.
Press coverage of the 2025 Verizon DBIR gave a median of 32 days with 54% of edge device flaws fully remediated (Infosecurity Magazine). A slide that drops the 54% fails check 8 in spirit, because it removes the unfinished work.
Wording that travels well
| Weak | Stronger |
|---|---|
| Most companies patch in 32 days | A 2025 breach report found a median of 32 days for edge device flaws that were fully fixed, with just over half completed |
| Attackers exploit in 5 days | One 2023 sample averaged 5 days, or 47 with outliers |
| We are faster than average | Our median for the same set is X days, measured from patch release |
What to do if you fail a check
Fail one or two, and add a footnote. Fail several, and replace the statistic with your own measured data, which you can define fully. Boards generally respond better to "here is how we measure and here is our trend" than to an external figure they cannot inspect.
Quick check
Is a news summary good enough as a source?
Use it to find the original, then cite the original. Summaries often leave out the methodology that gives the number meaning.
How many caveats are too many on a slide?
Keep one line of scope on the slide and put the rest in the notes or appendix. If the number needs a paragraph of caveats, pick a different number.
Safeguard supports this with continuous monitoring of your SBOM and dependencies, zero-day discovery, and policies and gates that you set yourself. The free scan at gold.safeguard.sh/scan is a quick way to see your own starting point.
Sources
- Mandiant (Google Cloud), How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends
- Infosecurity Magazine, Verizon DBIR reveals jump in vulnerability exploitation
Last reviewed: 19 October 2026.
