Measure time to remediate from the moment a finding is detected to the moment each deployment is verified fixed, then report the median and the slowest tail by tier and by owner. Do not stop the clock at merge, and do not blend all environments into one average.
Define the clock
Pick start and end events and write them down.
Start: the first time the finding was recorded in your inventory, or the advisory date if you can match it. Choose one and keep it.
End: the deployment is verified at the fixed version by a rescan or a digest check.
Only a rule that is applied the same way every month produces a trend you can trust.
Measure at the right level
| Level | What it tells you | Weakness |
|---|---|---|
| Per finding | Overall speed of triage and fix | Hides slow deployments |
| Per deployment | When exposure actually ended | More rows |
| Per owner | Which teams need help | Needs good ownership data |
Per deployment is the honest one, because exposure ends where code runs, not where the pull request merges.
Avoid the common traps
- Averages. A few very old items distort the mean. Use the median and show the 90th percentile or the oldest open item.
- Closed means merged. Count only verified deployment fixes.
- Mixing tiers. Report internet exposed, standard and contained systems separately, since they have different targets.
- Counting only what you fix. Include open items, with their age, or you reward quietly ignoring hard ones.
- Dropping exceptions. Show them as their own line with review dates.
A small report that works
For each tier, show: count opened, count verified fixed, median days to fix, oldest open item in days, number under exception. Add the same view per owning team for the top five teams by open items.
Handling a hybrid estate
On premises sites often move more slowly because of change windows. Show them as a separate series so you can see whether the gap is a process problem or a capacity problem. Give each series the same clock definition.
Connecting to external deadlines
CISA's catalog of known exploited vulnerabilities lists a due date for each entry. If you track against those dates, add a column for findings on that list so the report shows how you do against them. Check CISA's directive text before describing any obligation.
Try it yourself
Open the demo and follow a finding from detection through remediation. Note which events you would timestamp for the start and end of your clock.
Click through it at your own pace, or open it full screen.
Quick check
Should we report the mean or the median?
Report the median and the slowest tail. The mean is easily pulled by a handful of old items.
When does the clock start for a zero-day?
Define it in advance. Many teams use the time the issue was first recorded against a component they run.
Safeguard's vulnerability management and compliance and evidence automation keep the timestamps these reports need. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
