In a vulnerability fix report, half-life is the time it takes for half of the discovered flaws to be closed. It borrows from physics and is a survival style measure. It differs from an average fix time because it keeps unfinished flaws in the calculation instead of ignoring them.
Half-life, mean and median compared
| Measure | Counts open items | Answers |
|---|---|---|
| Mean time to fix | Usually no, only closed ones | What was the average among fixed items |
| Median time to fix | Usually no | How long did the middle fixed item take |
| Half-life | Yes | How long until half of everything found was fixed |
| Percent fixed by day N | Yes | How much was done by a given deadline |
If 40% of flaws are still open after a year, a mean of closed items might look fine. A half-life cannot be calculated until the 50% mark is passed, which tells you something by itself.
How reports use the term
Veracode's public sector snapshot states that the half-life for fixing flaws in the public sector is 315 days, compared with an overall figure of 252 days. The same page also describes 315 days as an "average" in its summary line (Veracode). That is an example of why vocabulary matters. A half-life and an average are different statistics, and a reader who sees both words may assume they are the same. Check the full report for the exact definition before you reuse a number.
Why half-life is useful
- It reflects the backlog, not just recent wins.
- It is hard to game by closing easy tickets first, because the hard ones stay in the denominator.
- It shows improvement as a shift of the whole curve, which is easier to explain to leadership than a single average.
Why it is not enough
A single half-life hides the shape. Two teams can share a half-life of 100 days while one fixes everything critical in a week and the other treats all severities alike. Pair it with a figure for your highest risk group, such as flaws on the CISA known exploited list or flaws that are reachable in your code.
Measuring your own
- Take all findings first seen in a quarter.
- Plot the share closed by day 7, 30, 90 and 180.
- Read the day when the line crosses 50%.
- Repeat for the critical subset.
A short worked example
Suppose 200 flaws are found in a quarter. By day 30, 60 are fixed. By day 90, 130 are fixed. By day 180, 170 are fixed. The line crosses 100, which is half, between day 30 and day 90, so the half-life is roughly two months. The mean of the 170 closed items would be lower or higher depending on which ones closed first, and it would ignore the 30 still open. The half-life stays honest because it is anchored to everything that was found.
Quick check
Can I compare my half-life to a published one?
Only if the populations, severities and clock start match. Use published numbers as context and track your own trend.
What if half my flaws are still open?
Then the half-life is longer than your observation window. Report it as "not yet reached" and show the percent closed instead.
Sources
Last reviewed: 19 October 2026.
