Average time to fix is computed from closed items only, so the oldest open vulnerabilities never enter it. Statisticians call those items censored. A fairer report is the share fixed within 7, 30 and 90 days, counting every item that started, whether it closed or not.
A small example
Illustrative data. Ten vulnerabilities were opened in the same month.
- Six were fixed after 5, 7, 9, 12, 20 and 30 days.
- Four are still open at 40, 45, 60 and 60 days.
The average of the closed ones is 83 divided by 6, about 13.8 days. That reads like a team that fixes things in two weeks. But four of ten items have been open for 40 days or more, and the average ignores them completely.
Now ask a different question: what share closed within 30 days? Six of ten, or 60 percent. That is the more honest summary, and it is also easier to compare with a policy.
Why the bias is not small
The slowest items are, by definition, the last to close. If you report the average every month, the items most likely to be missing are the ones that matter most. A team that stops closing hard issues sees its average improve, because easy ones keep flowing in and out.
This is the same problem that makes median survival hard to compute in medical studies where some patients are still alive when the study ends. Their data is still useful, even though the outcome is not known yet.
A simple way to report it
You do not need statistical software. Build a table from a cohort, which is all items that opened in the same period.
- List how many opened.
- For each cut off, 7, 30 and 90 days, count how many closed by then.
- Divide by the number opened, not by the number closed.
- For cohorts too recent to reach a cut off, mark the cell as not yet measurable rather than guessing.
For the ten item cohort: 7 days gives 2 of 10, 30 days gives 6 of 10, and 90 days gives at least 6 of 10 with four unresolved.
Reading the median honestly
If at least half the cohort has closed, you can read a median. Here the median is between the fifth and sixth items, 20 and 30 days, so about 25. If fewer than half had closed, the median would be undefined, and you should say so instead of reporting an average.
The same idea powers the full Kaplan-Meier method, which adjusts the curve as items drop out of observation. A simple cohort table captures most of its value for a security review.
Related reading
Our post on mean versus median versus p90 for remediation time covers which summary to pick for closed items. This post is about the items you left out. For the link between backlog size and time open, see Little's law for vulnerability backlogs.
Quick check
Is mean time to remediate a bad metric?
It is fine as a secondary number, but alone it ignores open items and hides a long tail. Report cohort percentages and the count still open next to it.
What about items closed as accepted risk?
Count them as closed but label them. Otherwise a team can improve the number by accepting risk instead of fixing anything.
Last reviewed: 19 October 2026.
