Report the median time to remediate as the headline, add a high percentile such as the 90th, and show the oldest open item. The mean is dragged around by a few extreme values, so it can look fine while a stubborn tail sits unfixed, or look terrible after one old finding closes.
Why the mean misleads
Remediation times are skewed. Most findings close within a normal sprint or two, and a handful stay open for months because they need a major upgrade, a vendor fix, or a risk decision. The mean adds all of them together, so the tail pulls it up.
Take a hypothetical team with nine findings closed in 5 days each and one closed after 200 days. The mean is about 24.5 days. The median is 5 days. Neither number is wrong, but they answer different questions. The median says what a typical fix looks like. The mean says very little about anyone's experience.
What each statistic is good for
| Statistic | Answers | Weakness |
|---|---|---|
| Median | How long does a typical fix take? | Ignores the tail |
| 90th percentile | How long do the slow ones take? | Needs enough volume to be stable |
| Mean | Total effort spread evenly | Skewed by outliers |
| Oldest open item | What is the worst case right now? | One data point |
A pair works well: median for the normal flow, 90th percentile for the tail. Executives get two numbers, and each one prompts a different action. A good median with a bad tail means the process is fine and a few hard problems need sponsorship. A bad median means capacity or ownership is the issue.
Closed items only is a trap
Time to remediate is computed on items that closed. That is survivorship bias. If the team closes easy things and leaves hard ones open, the median improves while risk stays flat. Pair every remediation time with the age of what is still open. An open age distribution, such as how many findings are older than 30, 60, and 90 days, catches this.
Steps to set it up
- Define the clock start. Many teams pick the day the finding was first detected. Write it down.
- Define the clock stop. Use the day a fix is verified in production, not the day a pull request opens.
- Segment by severity and exposure. A single blended median across everything is hard to act on.
- Check volume. With fewer than a couple of dozen closed items in a period, percentiles jump around. Say so, or widen the window.
- Chart the median and the 90th percentile by month, with open age beside them.
Common questions from the board
Executives often ask whether the number is going down. Show the trend with a short note on anything that changed how findings are counted, such as a new scanner. A change in method can move the number without any change in behavior.
Where Safeguard fits
Safeguard can help with the inputs behind this. It runs SBOM and dependency scanning, reachability analysis to separate reachable findings from the rest, and policies and gates that you set. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the findings list and sort by age. The spread between the youngest and oldest open items is the tail that a mean would blur.
Quick check
Is the mean ever the right choice?
Yes, when you are estimating total effort or cost and every item counts. For describing a typical experience or a service level, the median and a percentile are clearer.
What if we only close a few findings a month?
Use a longer window, such as a quarter, and show raw counts next to the statistic so readers can judge how much weight it deserves.
Last reviewed: 19 October 2026.
