Patch time reports raise the same questions again and again. The short answers: check the median and the completion rate, know where the clock starts, match scope before comparing, and use published figures as context for your own measured data, never as a target or a promise to a customer.
What does a patch time statistic usually measure?
The days between a start event and an end event for a set of vulnerabilities, summarized as a mean, median or half-life. Each of the three parts can differ between reports. The 2025 Verizon DBIR edge device result, a median of 32 days to full remediation with 54% completed, is one example (Infosecurity Magazine).
Why do reports disagree?
They use different populations, flaws, clocks and statistics. See how Tenable's sector averages ran far above a 32 day median for related edge flaws (Tenable).
Is the median better than the average?
Neither is better in general. A median shows the typical case, and an average shows the effect of the slow tail. Report both, plus the share still open.
What is a half-life?
The time until half of the discovered flaws are fixed. It keeps unfixed items in the calculation. Veracode's public sector snapshot gives 315 days for that sector against 252 overall (Veracode).
How fast do attackers exploit?
It varies. Mandiant's 2023 sample of 138 exploited vulnerabilities averaged five days to exploit with outliers excluded and 47 days with them included (Mandiant).
Does a vendor disclosure deadline tell me how fast to patch?
No. Google Project Zero's policy gives a vendor 90 days to release a patch after notification, with 7 days for flaws exploited in the wild (Project Zero). That is a vendor clock.
Can I use a report as my SLA?
Use it as context. Base the SLA on exposure, exploitation evidence and your own data.
What should I measure myself?
Median and 90th percentile days from patch release to verified fix, percent fixed within target, count and age of open items, and coverage of your inventory. Safeguard's continuous monitoring and SBOM based dependency scanning feed that kind of data for the software you build, and the free scan at gold.safeguard.sh/scan shows a starting point.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings are grouped and what each group would say about your own fix times.
One more habit
When a number surprises you, find the sentence in the report that defines it. Most confusion about patch statistics disappears in the methodology section, which is usually shorter than the executive summary and worth the five minutes.
Quick check
What is the fastest sanity check on any patch number?
Ask what was counted, when the clock started, and how many items were still open.
Is it safe to quote a figure from a news article?
Use it to find the original report and cite that. Summaries often omit method details.
Sources
- Infosecurity Magazine, Verizon DBIR reveals jump in vulnerability exploitation
- Tenable, Verizon 2025 DBIR research collaboration on CVE remediation trends
- Veracode, 2025 State of Software Security Public Sector Snapshot
- Mandiant (Google Cloud), How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends
- Google Project Zero, Vulnerability Disclosure Policy
Last reviewed: 19 October 2026.
