Mean Time to Patch Calculator

MTTP = total open-days ÷ findings closed, computed per severity and overall; severity-weighted MTTP = (5 × critical + 3 × high + 1 × medium) ÷ 9. Only closed findings count, because including open ones biases the mean downward — a critical that has been open 200 days contributes nothing until someone fixes it. The severity-weighted figure exists because an unweighted mean is dominated by the volume of mediums and will look excellent while criticals rot.

MTTP per severity is the one vulnerability-management metric executives and regulators both understand, and the gap against SLA is what turns it into a decision about headcount or automation.

This calculator takes 8 inputs: Critical findings closed, Total open-days across those criticals, High findings closed, Total open-days across those highs, Medium findings closed, Total open-days across those mediums, Critical SLA, High SLA. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Report both. The mean is what SLAs are written against, but it is dragged by a handful of ancient findings, so a median well inside SLA with a mean outside it tells you that you have a long-tail problem rather than a throughput problem.

For an SLA you can be held to, start at detection — you cannot act on what you have not found. Track disclosure-to-detection separately in the exposure window calculator, because that lag is an inventory and intelligence problem, not a patching one.