To compare your patch times to a published report, recompute your data using the report's scope, clock start, definition of done and statistic. If you cannot match all four, compare only the direction of your own trend and treat the report as background.
Step by step
- Copy the definitions. From the methodology, note the vulnerability set, the start event, the end event and the statistic.
- Filter your data to the same set. If the report covers known exploited edge flaws, filter your findings the same way. The CISA catalog is a public list you can match against (CISA).
- Align the clock. Use patch release as the start if the report does. If your tool only records detection, you will need vendor advisory dates.
- Align the end. Count only verified fixes if the report counted full remediation.
- Use the same statistic. A median compared with a mean is not a comparison.
- Add the completion rate. Show the share still open next to your time.
A template for the result
| Item | Report | Your data |
|---|---|---|
| Set | Edge device CVEs | Same CVEs you run |
| Start | Patch release | Patch release |
| End | Full remediation | Verified rescan |
| Statistic | Median | Median |
| Completion | 54% | Your share |
| Time | 32 days | Your median |
The report figures in this table come from press coverage of the 2025 Verizon DBIR (Infosecurity Magazine). If you cannot fill every row, say so in the result.
When you cannot match the method
Often you cannot. The raw data is not public. In that case:
- Do not publish a "we beat the benchmark" claim.
- Show your own trend by quarter, split by exposure.
- Mention the report as context and name what differs.
What a fair comparison can tell you
If your median for the same set is far above the report's, find the longest segment: approval, testing or deployment. If it is far below, check whether your inventory is complete, since missing assets make times look better. Either result is a prompt for a question, not a score.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings age over time, which is the raw material for any fair comparison.
Keep a record
Write down the definitions you used and keep the query. Next quarter you can rerun it with the same filters and the trend will be honest. A comparison you cannot reproduce is a one off opinion.
Quick check
Can I benchmark without the report's raw data?
Only roughly. Use the published definitions to compute a similar figure from your data and label the comparison as approximate.
What if my inventory is incomplete?
Then your times are optimistic. Fix coverage first, or state the share of assets covered.
Safeguard supports this with continuous monitoring of your SBOM and dependencies, zero-day discovery, and policies and gates that you set yourself. The free scan at gold.safeguard.sh/scan is a quick way to see your own starting point.
Sources
- CISA, Known Exploited Vulnerabilities Catalog
- Infosecurity Magazine, Verizon DBIR reveals jump in vulnerability exploitation
Last reviewed: 19 October 2026.
