Time to patch vulnerabilities measures how quickly critical security patches are applied after vulnerabilities are identified. It turns remediation speed into a business-relevant indicator of operational continuity, breach exposure, and customer trust. section 4.2.2 section 4.1.1
Use the metric to:
- Set an acceptable remediation timeframe for critical vulnerabilities. section 4.1.1
- Compare patching speed across risk categories, such as zero-day vulnerabilities and misconfigurations. section 10.7
- Support resource allocation and risk-prioritization decisions rather than reporting raw technical activity alone. section 4.1.1
MediHealth’s 24-hour target
MediHealth reduced the time required to patch critical systems from 48 hours and set a 24-hour target. Reporting the current 48-hour result makes the remaining gap visible, while automating patch management provides a concrete improvement action. Meeting the target supports uninterrupted operations and stronger compliance progress. section 4.2.5
Interpret the metric alongside vulnerability risk and business impact. A faster average may conceal slower remediation for especially dangerous vulnerabilities, so category-level comparisons help show whether mitigation is improving where it matters most. section 10.7 section 4.1.1
