Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper critiques the reliance on mean time to remediate (MTTR) as a standalone metric for enterprise vulnerability management, proposing a remediation-cadence audit that assesses how fixes are deployed across various methods. By analyzing factors such as release period, cohort geometry, and emergency versus routine splits, the study reveals that traditional MTTR metrics can obscure the true efficiency of remediation efforts. The findings indicate that different release strategies significantly impact the effective capacity consumed, suggesting that MTTR alone is insufficient for evaluating remediation effectiveness in the face of residual pressure and uncertainty.
MTTR can mislead security teams by masking the true efficiency of vulnerability remediation, with release strategies consuming vastly different capacities.
Enterprise security teams commonly summarize remediation through mean time to remediate (MTTR), SLA compliance, dwell time, or detection delay. These metrics are useful, but they can hide how fixes actually reach the estate: continuously, through scheduled maintenance windows, in deployment rings, or through emergency bypass paths. This paper introduces a remediation-cadence audit for enterprise vulnerability management. The audit records routine mean lag, release period, release fraction, cohort geometry, emergency/routine split, non-fielding delay, local residual-pressure evidence, and declared rate scenario. It compares a continuous same-mean shortcut with the recorded release calendar and reports a local capacity verdict plus a calendar discount: the fraction of mean-only local capacity consumed by calendarized fielding. Worked notional packets with the same 30-day mean lag show why this matters. Under the normalized screening scenario, a two-month release train consumes 17.4\% of mean-only capacity, a monthly train 5.2\%, and a two-week screen 1.3\%; across a 16-fold attacker-adjustment rate band, the two-month discount remains at least about 12\% and the monthly discount stays in the resolution-sensitive 3--8\% range. The audit therefore turns cadence assessment into an evidence-resolution question: when the discount is material relative to residual-pressure uncertainty or claimed headroom, MTTR/SLA should not be used alone as fielding evidence. Release-geometry checks show that deployment rings do not automatically recover the continuous benchmark, and cohort staggering can help or hurt near capacity. The result is a reproducible governance diagnostic, not a breach predictor or CVE prioritizer.