Two reports can look at similar edge device vulnerabilities and give very different times because they use different statistics and different populations. One reported a median of 32 days for the flaws that were fully fixed. Another reported sector averages running from 12 days to roughly 300 days. Both can be accurate.
The two figures
Press coverage of the 2025 Verizon DBIR reported that 54% of edge device vulnerabilities were fully remediated, with a median of 32 days to get there (Infosecurity Magazine).
Tenable Research contributed data to that report and published its own analysis of 17 edge device CVEs, using its telemetry. It showed average remediation times per sector and per vulnerability. For one pair of zero-day flaws on network appliances, the lowest sector average was 160 days. For another pair, averages ran from 172 days to over 260 days. For a third pair, even the quickest sector took more than 260 days. For one management product flaw, a communications sector averaged 12 days and healthcare 71 days (Tenable).
Why a median of 32 and an average of 160 can coexist
| Factor | Median style figure | Average style figure |
|---|---|---|
| What it summarizes | The middle organization | Every organization, slow ones included |
| Effect of a long tail | Barely moves | Pulled upward |
| Typical question answered | How long does a typical fix take | How long does the group take overall |
| Unfixed items | Often outside the calculation | Depends on how they are handled |
The first row matters most. If many organizations fix quickly and a few take most of a year, a median describes the fast group and an average describes the whole spread. Neither is wrong. They answer different questions.
What else differs
Scope can differ even when both sources look at "edge devices". A report may count by organization, by device, or by CVE. The data source differs too: breach investigation data and scanner telemetry see different slices of the world. And the clock start may differ: a median measured from the moment a fix was available is not comparable with an average measured from the first scan.
What to do with both numbers
- Treat them as two readings of a spread, not a contradiction.
- Quote each with its statistic and scope.
- Ask which one matches your decision. If you set a target for a typical fix, a median is relevant. If you worry about the slowest assets, look at the tail or a high percentile of your own data.
A small example
Take ten organizations and one vulnerability. Seven fix it in about 20 days. Three take 250 days. The median is 20 days. The average is 89 days. Both are correct, and both describe the same ten organizations. Now add that two organizations never fix it at all and are dropped from the calculation, and the median looks better still. That is the mechanism behind many apparent contradictions, and it is why a pair of figures should be read together rather than chosen between.
Quick check
Does this mean one of the reports is wrong?
Not necessarily. The statistics, populations and clocks differ, so they are not measuring the same thing. Check each methodology before concluding anything.
Which number should I put in a board slide?
Use your own measured figure with its definition, and cite an external number only as context, with its statistic and scope named.
Sources
- Infosecurity Magazine, Verizon DBIR reveals jump in vulnerability exploitation
- Tenable, Verizon 2025 DBIR research collaboration on CVE remediation trends
Last reviewed: 19 October 2026.
