Work out MTTP overall and per severity from your closed findings, and compare each figure against its remediation SLA.
Only closed findings count, because including open ones biases the mean downward — a critical that has been open 200 days contributes nothing until someone fixes it. The severity-weighted figure exists because an unweighted mean is dominated by the volume of mediums and will look excellent while criticals rot. MTTP per severity is the one vulnerability-management metric executives and regulators both understand, and the gap against SLA is what turns it into a decision about headcount or automation.
Mean Time to Patch
MTTP = total open-days ÷ findings closed, computed per severity and overall; severity-weighted MTTP = (5 × critical + 3 × high + 1 × medium) ÷ 9.
SLA gap
SLA position = MTTP for that severity − the SLA in days; a positive number is the average breach size.
MTTP = total open-days ÷ findings closed, computed per severity and overall; severity-weighted MTTP = (5 × critical + 3 × high + 1 × medium) ÷ 9. Only closed findings count, because including open ones biases the mean downward — a critical that has been open 200 days contributes nothing until someone fixes it. The severity-weighted figure exists because an unweighted mean is dominated by the volume of mediums and will look excellent while criticals rot.
MTTP per severity is the one vulnerability-management metric executives and regulators both understand, and the gap against SLA is what turns it into a decision about headcount or automation.
This calculator takes 8 inputs: Critical findings closed, Total open-days across those criticals, High findings closed, Total open-days across those highs, Medium findings closed, Total open-days across those mediums, Critical SLA, High SLA. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Report both. The mean is what SLAs are written against, but it is dragged by a handful of ancient findings, so a median well inside SLA with a mean outside it tells you that you have a long-tail problem rather than a throughput problem.
For an SLA you can be held to, start at detection — you cannot act on what you have not found. Track disclosure-to-detection separately in the exposure window calculator, because that lag is an inventory and intelligence problem, not a patching one.