Measure the days between disclosure and deployment, the asset-days at risk and the cumulative chance of exploitation in that window.
The window has three segments and you own two of them. Detection lag is an asset-inventory and intelligence problem; deployment lag is a change-management problem; only patch availability belongs to the vendor. Because cumulative probability compounds geometrically, halving the window removes rather more than half the risk at low daily rates and much more at high ones. Almost every breach traced to a known CVE happened inside a window that someone had already measured and tolerated — the number only helps if it drives the deployment lag down.
Exposure Window
Exposure window = detection lag + patch-availability lag + deployment lag. Cumulative exploitation probability = 1 − (1 − dailyProbability)^window, and asset-days at risk = window × affected assets.
Aggregate exposure
Asset-days at risk = window × assets — the aggregate measure that makes a 3-day window across 5,000 hosts comparable to a 60-day window across 250.
Exposure window = detection lag + patch-availability lag + deployment lag. Cumulative exploitation probability = 1 − (1 − dailyProbability)^window, and asset-days at risk = window × affected assets. The window has three segments and you own two of them. Detection lag is an asset-inventory and intelligence problem; deployment lag is a change-management problem; only patch availability belongs to the vendor. Because cumulative probability compounds geometrically, halving the window removes rather more than half the risk at low daily rates and much more at high ones.
Almost every breach traced to a known CVE happened inside a window that someone had already measured and tolerated — the number only helps if it drives the deployment lag down.
This calculator takes 5 inputs: Disclosure to your detection, Detection to vendor patch available, Patch available to fully deployed, Affected assets, Daily probability of exploitation attempt. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Then the middle segment is fixed and the only lever is mitigation: virtual patching, disabling the feature or isolating the asset. Log the mitigation date as the effective end of the exposure window for risk purposes, and the real patch date for compliance.
Derive it from EPSS: a 30-day EPSS score of p implies a daily rate of 1 − (1 − p)^(1/30). For a 6% EPSS score that is about 0.2% per day. Use the exploit probability calculator to do the conversion.