Skip to content
ENExplore Calculators

Mean Time to Patch Calculator

Work out MTTP overall and per severity from your closed findings, and compare each figure against its remediation SLA.

About Mean Time to Patch Calculator

Only closed findings count, because including open ones biases the mean downward — a critical that has been open 200 days contributes nothing until someone fixes it. The severity-weighted figure exists because an unweighted mean is dominated by the volume of mediums and will look excellent while criticals rot. MTTP per severity is the one vulnerability-management metric executives and regulators both understand, and the gap against SLA is what turns it into a decision about headcount or automation.

Formulas

Mean Time to Patch

MTTP = total open-days ÷ findings closed, computed per severity and overall; severity-weighted MTTP = (5 × critical + 3 × high + 1 × medium) ÷ 9.

open-days
Days between discovery and verified remediation, summed
MTTP
Mean time to patch in days
5 / 3 / 1
Severity weights so a slow critical outweighs a slow medium

SLA gap

SLA position = MTTP for that severity − the SLA in days; a positive number is the average breach size.

Worked example

With the default values below, Mean Time to Patch Calculator returns Overall MTTP of 42.8. Change any input above and every figure here is recalculated in your browser.

Inputs used

Critical findings closedaccepts 0–100,000 findings
18 findings
Total open-days across those criticalsaccepts 0–10,000,000 days
210 days
High findings closedaccepts 0–100,000 findings
64 findings
Total open-days across those highsaccepts 0–10,000,000 days
1,920 days
Medium findings closedaccepts 0–100,000 findings
190 findings
Total open-days across those mediumsaccepts 0–10,000,000 days
9,500 days
Critical SLAaccepts 1–365 days
7 days
High SLAaccepts 1–365 days
30 days

Results

Overall MTTP
42.8 days
Critical MTTP
11.7 days
High MTTP
30.0 days
Medium MTTP
50.0 days
Severity-Weighted MTTP
22.0 days
Critical SLA Position
Breaching SLA by 4.7 days on average
High SLA Position
Within SLA with 0 days of margin

Step by step

  1. 1Values used
  2. 2Mean Time to Patch
  3. 3SLA gap
  4. 4Overall MTTP= 42.8 days
  5. 5Critical MTTP= 11.7 days
  6. 6High MTTP= 30.0 days
  7. 7Medium MTTP= 50.0 days
  8. 8Severity-Weighted MTTP= 22.0 days
  9. 9Critical SLA Position= Breaching SLA by 4.7 days on average

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Mean Time to Patch calculated?

MTTP = total open-days ÷ findings closed, computed per severity and overall; severity-weighted MTTP = (5 × critical + 3 × high + 1 × medium) ÷ 9. Only closed findings count, because including open ones biases the mean downward — a critical that has been open 200 days contributes nothing until someone fixes it. The severity-weighted figure exists because an unweighted mean is dominated by the volume of mediums and will look excellent while criticals rot.

Why does Mean Time to Patch matter?

MTTP per severity is the one vulnerability-management metric executives and regulators both understand, and the gap against SLA is what turns it into a decision about headcount or automation.

What values do I need to enter?

This calculator takes 8 inputs: Critical findings closed, Total open-days across those criticals, High findings closed, Total open-days across those highs, Medium findings closed, Total open-days across those mediums, Critical SLA, High SLA. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I report the mean or the median?

Report both. The mean is what SLAs are written against, but it is dragged by a handful of ancient findings, so a median well inside SLA with a mean outside it tells you that you have a long-tail problem rather than a throughput problem.

Does the clock start at disclosure or at detection?

For an SLA you can be held to, start at detection — you cannot act on what you have not found. Track disclosure-to-detection separately in the exposure window calculator, because that lag is an inventory and intelligence problem, not a patching one.

Related Calculators

Mean Time to Patch Calculator | Calcrivo