Rank security fixes by cost of delay divided by duration: how much risk you carry for each extra week of waiting, divided by the weeks the fix will take. Do the highest scores first. Short, urgent fixes jump the queue, and long, slow-burn work gets scheduled deliberately.
What cost of delay means here
Cost of delay is a product planning idea. One summary of it describes it as the answer to "what would it cost us if this was delayed by 1 month?" When the same figure is divided by the time the work takes, the method is often called CD3, and it is the basis of the Weighted Shortest Job First scheduling approach (see Sources).
Security backlogs suit this because the value of a fix leaks away over time in a visible way. A vulnerability that attackers are already using costs more each week than one with no known exploit. A fix that is cheap and urgent should not wait behind a large, important refactor.
Step 1: score the weekly cost of waiting
You do not need dollars. A three-point scale agreed by the team works if everyone uses the same definitions.
| Score | Meaning |
|---|---|
| 3 | Exploitation is known or likely, and the asset is reachable from outside |
| 2 | Plausible exploitation, or a customer or audit date is approaching |
| 1 | Hygiene work with no near-term trigger |
Use public signals to set the score instead of arguing. The CISA Known Exploited Vulnerabilities catalog lists vulnerabilities with evidence of exploitation, and each entry carries a date added and a due date. EPSS publishes a daily probability that a CVE will be exploited in the next 30 days. Neither replaces your own knowledge of where the component runs, but they settle many debates quickly.
Step 2: estimate duration in weeks of elapsed time
Use the engineer's estimate for the real path to done: change, review, test, deploy. If a fix needs another team, include their queue time. A one line version bump might be a day. A framework migration might be six weeks. Round to whole weeks and do not pretend to more precision than you have.
Step 3: divide and sort
Here is an example with made up figures, to show the arithmetic only.
| Item | Cost of delay (1 to 3) | Duration (weeks) | Score |
|---|---|---|---|
| Patch an exploited library in the public API | 3 | 1 | 3.0 |
| Add rate limiting to login | 2 | 2 | 1.0 |
| Migrate off an old auth framework | 3 | 12 | 0.25 |
| Remove unused admin routes | 1 | 1 | 1.0 |
The score does not say the migration is unimportant. It says the migration should be chopped into slices so something ships each sprint, because one twelve week block scores badly against a stream of smaller wins. Break it into pieces that each reduce exposure on their own, then rescore the pieces.
Where the method misleads
Treat the score as a conversation starter, not a verdict. Three common failure modes:
- A fix with a huge impact but unknown duration will score oddly. Time-box a spike first, then score it.
- Scores drift as news arrives. Re-run the ranking when a CVE is added to a known exploited list, not only at planning.
- Small items can crowd out the one big risk. Keep a standing slot for the top item by cost of delay, even if its score is low.
Try it yourself
Open the exploitability demo, then compare how a finding looks when you ask whether it can be exploited in your environment. That question is what moves an item from a 1 to a 3 in the scoring above.
Click through it at your own pace, or open it full screen.
Safeguard supplies reachability analysis and policy gates that feed the cost of delay score with evidence about whether a flaw is reachable in your code. You can run a free scan at gold.safeguard.sh/scan to see what your own dependencies look like.
Quick check
Do I need dollar figures for cost of delay?
No. A shared three-point scale with written definitions is enough to order a backlog. Add dollars only if finance asks and you can defend the numbers.
Is this the same as CVSS ranking?
No. CVSS describes severity in general. Cost of delay adds your context, such as exposure and urgency, and divides by effort so cheap fixes are not buried.
Sources
- Cost of delay, Wikipedia
- CISA Known Exploited Vulnerabilities Catalog
- Exploit Prediction Scoring System, FIRST
Last reviewed: 19 October 2026.
