Track five durations from your tracker: time to acknowledge, time to validate, time to release a fix, time to publish an advisory, and the share of promised updates sent on the date you gave. Review them quarterly, look at the slowest case, and ignore averages across very few cases.
Why keep metrics small
A small team may see a handful of reports a year. Dashboards and percentiles mean little with so few cases. What helps is a clear record per case and a few durations that point to where time goes. This article does not give benchmark numbers, because no figures are claimed here that were not verified. Compare yourself with your own policy and your own history.
The five measures
| Measure | Starts | Ends | What it shows |
|---|---|---|---|
| Time to acknowledge | Report received | First human reply | Is intake watched? |
| Time to validate | Acknowledged | Outcome recorded | Do you have a test environment and a validator? |
| Time to fix | Confirmed | Fix released | Engineering speed and release process |
| Time to publish | Fix released | Advisory live | Is advisory writing a bottleneck? |
| Updates on time | Each promised date | Update sent | Do you keep your word? |
The last one matters most to reporters. You can have a slow fix and still keep trust if each update arrives when promised.
How to use the numbers
- Compare with your policy. If the policy says you acknowledge within two working days, count how many cases met it.
- Read the slowest case, not the average. Ask what held it up.
- Look for the longest gap. Where does the clock run longest on most cases? That step is your constraint.
- Check for open cases. Any case with no outcome and a past update date goes to the top of the weekly review.
- Do not set targets you cannot meet. A target missed every time teaches the team to ignore it.
Things not to measure
- Number of reports as a score of security. More reports can mean a healthier channel.
- Number of reporters rejected as a proxy for quality.
- Fix speed alone, without checking whether the fix was complete.
- Anything that rewards closing cases quickly over getting them right.
Reporting upward
Give leadership a one page summary each quarter: cases received, cases closed with outcomes, the five durations for each, and one improvement you plan. Keep reporter identities and unfixed details out of it.
Link to your policy
Make sure public promises match what you measure. The post on a vulnerability disclosure policy checklist lists what to state publicly. If you publish a target, measure it.
Try it yourself
The vulnerability management demo shows how states and ages appear together for each item. Click through and look for how age is visible at a glance.
Click through it at your own pace, or open it full screen.
Quick check
Do we need a tool to measure these?
No. A spreadsheet with dates is enough if you fill it in as you go.
What is a good time to acknowledge?
There is no universal figure. Choose a target your team can meet when people are on leave, publish it, and measure against it.
Safeguard's compliance and evidence automation can help keep dated records of how each case was handled. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
