Mean time to remediate

What it means

Mean time to remediate, often shortened to MTTR, is the average number of days between a vulnerability being confirmed and it being fixed. You add up the time each finding took and divide by the number of findings. It is usually tracked separately for each severity.

The letters MTTR are also used for mean time to recover and mean time to respond, so say which you mean. Here the clock starts at confirmation and stops at a verified fix. Start and stop points must be defined once and kept the same, or the trend means nothing.

Why it matters

It is one of the few numbers that shows whether security work actually reaches the product. A pile of reports does not reduce risk. Fixes do, and MTTR tells you how quickly they happen. A falling number for critical and high findings is a good sign that process and ownership are working. That makes it a useful number for a board, a customer or an audit, as long as it is measured the same way each time.

Customers and boards ask for it because it is easy to understand. It also feeds your remediation SLA: if the average for high findings is longer than the promised window, the promise is not being kept. It also feeds your risk register, since slow fixing is itself a risk worth recording.

How it shows up

It comes from your ticketing system or findings tool, using dates for found, fixed and verified. Report it by severity and by team, and show the median or the slowest ten percent beside the mean, because a handful of very old findings can drag the average far from what most tickets experience.

The usual distortions are closing tickets early, not counting findings that are accepted or dropped, and starting the clock late. A finding marked fixed that still works inflates the figure falsely. Stop the clock only on a verified fix, and track reopened tickets as well.