Little's law says the average number of open items equals the arrival rate times the average time each stays open. For vulnerabilities, backlog equals new findings per week times average weeks to close. It gives you a fast check on any backlog number and shows that cutting time to fix shrinks the pile faster than working harder.
The law in one line
L equals lambda times W. L is the average count in the system, lambda is the average arrival rate, and W is the average time in the system. It holds for any stable process, without assumptions about the order of work.
A worked example
Illustrative numbers. Your tracker shows 600 open vulnerabilities. Over the last quarter your team closed about 40 per week, and new ones arrived at about 40 per week, so the backlog is roughly steady.
- L is 600, lambda is 40 per week.
- W is 600 divided by 40, which is 15 weeks.
So a typical item waits about 15 weeks. That may or may not match what people believe. If the SLA says 30 days and the math says 15 weeks, either the SLA is not met or the backlog is full of items nobody plans to fix.
What each lever does
Rearranged, the law gives you three ways to change L.
- Lower the arrival rate. Fewer findings come in if you drop unused dependencies, upgrade base images, or stop alerting on code you do not ship. Halving lambda halves L.
- Lower the time in system. If you get W from 15 weeks to 5 weeks at the same arrival rate, L falls from 600 to 200.
- Close faster than arrivals. This is just a way to reduce W for a while, and the backlog returns to the law's value once rates match.
Notice what hiring does. More fixers shortens W only if the queue is the bottleneck. If items wait for approvals, release windows or vendor patches, extra people change little.
Cautions
- The law holds on average over a steady period. A one time cleanup sprint breaks the steady state.
- Measure W on closed items only if arrivals have been flat. Otherwise old stuck items distort it. Our post on survival curves for open vulnerabilities covers a better way to handle them.
- Include items closed as accepted or won't fix, or state clearly that you excluded them. Excluding them makes W look better and L look smaller than the tracker.
- One number hides different classes. Compute it per severity, since critical items should have a much smaller W than low ones.
Using it in a review meeting
Put three numbers on one slide: items open, new items per week, and implied average age from the law. Then compare the implied age with the real age distribution from the tracker. If the two disagree by a lot, the tracker is probably missing items or the process is not steady, and that is worth investigating before arguing about targets.
Quick check
Does Little's law need the queue to be first in, first out?
No. It holds regardless of the order work is done, as long as the system is stable over the period you measure.
Can I use it for a backlog that is growing?
Only over a window long enough to average out the growth. For a clearly growing backlog, arrivals exceed closures and the simple relation will mislead.
Last reviewed: 19 October 2026.
