How to calculate Time to Patch

Time to patch covers the entire process of discovering and patching a vulnerability. In a given timeframe, you’ll need to know the number of bugs discovered, and the amount of time it took to patch each vulnerability. Time spent patching / Number of patches created in a given timeframe = Time to patch To create an example, if your total number of minutes spent on discovering and deploying a patch in a 6-month period was 280 minutes and you had 3 bugs, that would mean your time to patch would be a rounded 93.4 minutes. The downside of using this metric is the lack of context. This calculation doesn’t specify the severity of a vulnerability or how labor-intensive it was to patch. Still, time to patch can give you a little insight into how efficient your team is in attacking vulnerabilities as they happen.