Glossary
MTTR (Mean Time to Remediate)
The average time between detecting a vulnerability on an asset and verifying that it has been remediated.
Mean Time to Remediate (MTTR) measures how long vulnerabilities stay open, from first detection on an asset to verified resolution. It is the most common headline metric in vulnerability management because it reflects the speed at which an organization removes risk.
Used carelessly, it misleads. Remediation times are heavily skewed, so a few very old findings pull the mean around; and an MTTR computed only on closed findings ignores everything still open, rewarding teams that fix easy items and leave hard ones. Report the median and a high percentile alongside the mean, segment by priority tier, and show the age of open findings next to it.
For a VOC, MTTR per tier is best paired with SLA compliance and exposure to known exploited vulnerabilities. See vulnerability management metrics.