Report both, and add a high percentile. The average is pulled around by a few very old findings, the median ignores them entirely, and neither shows what is still open. A median plus a 90th percentile, next to the age of the oldest open item, gives an honest picture of how fast you fix.
The same data, three stories
Take five fixed findings with these ages in days: 1, 2, 2, 3 and 92. This is a made-up illustration, not data from any real team.
| Measure | Result | What it suggests |
|---|---|---|
| Average | 20 days | "We are slow" |
| Median | 2 days | "We are fast" |
| Maximum | 92 days | "We have a stuck item" |
Both of the first two statements are misleading alone. The truth is a fast routine process and one stuck item that needs a person to look at it.
Why this matters for security
Vulnerability fix times are rarely bell shaped. Most items close quickly through routine dependency bumps, and a few linger for reasons such as a breaking upgrade, an unowned service or a vendor dependency. That shape is exactly where averages mislead.
Two further traps:
- Survivorship. Time to fix only includes items that were fixed. If the old, hard ones are still open, the number looks better than reality. Always show the age of open items too.
- Mixing populations. A single figure across critical and low findings, or across ten teams, hides the group that is struggling. Split by severity band or by owner.
Steps to build the report
- Pick the start time (detection or first seen by your tool) and keep it fixed. Changing the start time rewrites history.
- Pick the end time (fix merged, or fix deployed). Deployed is closer to what reduces exposure.
- Compute the median and the 90th percentile of closed items for the period.
- Add the age of the oldest open item and the count of open items older than your window.
- Split by the severity or context band that has a defined response window.
Percentile in plain words
The 90th percentile is the value that nine in ten items beat. If your 90th percentile is far above your median, you have a long tail, and the long tail is where unfixed exposure usually sits.
DORA, the software delivery research program, describes its metrics as a way for teams to see how they are doing today, prioritise improvements and validate progress. Treat fix times the same way. Use them to find stuck work, not to rank people.
Small samples
With very few items in a period, any statistic is unstable. Say how many items back each number, or widen the period. A median of three items is an anecdote.
Safeguard offers SBOM and dependency scanning, reachability analysis and policy gates, which gives you a consistent detection time to measure from. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is the median always better than the average?
No. The median hides a long tail. Use it together with a high percentile and the oldest open age.
Should time to fix start at disclosure or at detection?
Either works if you pick one and keep it. Detection in your own tooling is easier to audit.
Sources
Last reviewed: 19 October 2026.
