Six myths show up again and again around patch time reports: that one number describes everyone, that averages are enough, that faster than average is safe, that patching equals fixing, that vendor speed equals customer speed, and that a short exploit window is a universal law. Each fails when you check the source.
Myth 1: There is one industry patch time
Fact. Variation is large. In Tenable's analysis of 17 edge device CVEs, one communications sector averaged 12 days on a flaw where healthcare averaged 71, while for other flaws even the fastest sector took more than 260 days (Tenable).
Myth 2: The average tells the story
Fact. An average mixes fast and slow. Median coverage of the 2025 DBIR was 32 days for completed edge device fixes, yet only 54% were completed (Infosecurity Magazine). You need both the time and the completion rate.
Myth 3: Faster than the benchmark means safe
Fact. Benchmarks describe groups, not attackers. Mandiant's sample of 138 exploited vulnerabilities from 2023 averaged five days to exploit once outliers were excluded (Mandiant). Being average in a group does not close the window for your own exposed system.
Myth 4: Patched means fixed
Fact. A package bump that was never deployed, or a mitigation that hides a flaw, is not a fix. Define done as running and verified.
Myth 5: Vendor speed is customer speed
Fact. A disclosure deadline such as Project Zero's 90 days for a vendor to release a patch covers the vendor segment only (Project Zero). Your install time is a separate clock.
Myth 6: Exploitation always follows within days
Fact. Mandiant's own data show that time-to-exploit varies hugely and that averages were sensitive to outliers: five days without them, 47 with them. Of its 138 flaws, 97 were exploited as zero-days, before a patch existed, so the window for those was not about patching speed at all.
A summary table
| Myth | Better question |
|---|---|
| One number fits all | Whose data and which flaws? |
| Average is enough | What is the median and the completion rate? |
| Faster than average is safe | Is my exposed asset fixed in time? |
| Patched equals fixed | Is the fixed version running and verified? |
| Vendor speed equals mine | Which clock is this? |
| Exploitation is always fast | What does the sample and exclusion say? |
Safeguard can help with the inventory side of this. Its SBOM and dependency scanning and reachability analysis show which vulnerable components you run and which your code actually calls. You can try the free scan at gold.safeguard.sh/scan.
Quick check
Which myth is most costly?
Treating a number as universal. It leads teams to set targets or relax based on a group that does not resemble them.
Are all reports unreliable?
No. Good reports state their methods. The risk is in how numbers are repeated without them.
Sources
- Tenable, Verizon 2025 DBIR research collaboration on CVE remediation trends
- Infosecurity Magazine, Verizon DBIR reveals jump in vulnerability exploitation
- Mandiant (Google Cloud), How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends
- Google Project Zero, Vulnerability Disclosure Policy
Last reviewed: 19 October 2026.
