Mean time to remediate is a poor single number because a handful of very old findings can drag it up, while many quick fixes can hide them. Report the median for the typical fix, the 90th percentile for the slow tail, and split both by severity.
What goes wrong with an average
Remediation times are not evenly spread. Most fixes land within days. A few sit for months because they need a major version upgrade or a vendor patch that does not exist yet.
An average blends those two groups into one figure that describes neither. If nine findings close in two days and one closes in 200, the mean is about 22 days. No finding actually took 22 days. The number is real arithmetic and useless as a description.
The three numbers worth showing
Use these together, on one small table:
- Median time to fix. Half of your fixes were faster than this. It tells you how the typical ticket behaves.
- 90th percentile (p90). Nine in ten fixes were faster. It shows the tail, which is where risk sits.
- Count of items still open past SLA. This is the part the closed items cannot show you.
The third one matters most. Any time to remediate metric is computed from closed items only. Findings that are still open are invisible to it, so a team that closes easy items and ignores hard ones will look better every month.
Compute it per severity, not across everything
A critical that took 40 days and a low that took 40 days are different events. Mixing them gives you a figure that moves when your finding mix moves, even if behaviour did not change.
Group by severity or by your own priority tier. If you use exploit signals to set tiers, group by those instead. Keep the groups small enough that each one has a meaningful number of items. With fewer than 10 closed items in a group, show the raw list rather than a percentile.
Handle the open items explicitly
Add one more view: the age of everything still open, shown as a median and a maximum. Compare it with the closed time. If open items are much older than closed ones, your closed metric is flattering you.
Also decide how to treat reopened findings. A fix that regresses should reset the clock or count as a second event. Pick one and document it, because the choice changes your numbers.
A short example
Say a team closed 12 high severity findings last quarter. Times in days: 1, 1, 2, 2, 3, 3, 4, 5, 6, 8, 30, 90. The mean is about 13. The median is 3.5. The p90 is in the 30 to 90 day range.
Reporting "13 days" invites the wrong conversation. Reporting "typical 3.5 days, but two items took 30 and 90" starts the right one: why did those two stall, and who owns them?
Where Safeguard fits
If you track findings in the Safeguard platform, dependency scanning and reachability analysis give you a prioritised queue to measure against. A free scan shows what your current queue looks like before you decide on tiers.
Quick check
Is the median always better than the mean?
For skewed data like remediation times, usually yes for describing the typical case. Keep the p90 or maximum next to it so you do not lose sight of the tail.
Do I need a statistics tool for percentiles?
No. A spreadsheet percentile function over the closed durations is enough for a small program.
Last reviewed: 19 October 2026.
