Engineering Security Metrics Operational

Time to Patch

Time to Patch: Time from a vulnerability being discovered to its patch being deployed, for patches deployed in the period.

Formula

Time to Patch = Average of (Patch deploy time - Disclosure time)

Computable definition

The canonical formula in the GASP formula grammar. The MCP server compiles it to SQL over the datasets listed below.

(avg(field.patched_at - field.discovered_at where in_period(field.patched_at))) * 24

Unit: hours

Notes: Patch deploy time minus disclosure time.

Data requirements

Grain: Per event · Frequency: Per incident · Aggregation: event · Staged: no · Main source: Security Scanner.

Field	Dataset	Type
`discovered_at`	vulnerability	timestamp
`patched_at`	vulnerability	timestamp
`snapshot_date`	vulnerability	date

Example SQL (Postgres)

SELECT ((SELECT AVG((EXTRACT(EPOCH FROM (patched_at - discovered_at)) / 86400.0)) FROM vulnerability WHERE snapshot_date = :period_end AND (patched_at >= :period_start AND patched_at < (:period_end + INTERVAL '1 day'))) * 24) AS time_to_patch

From an agent: with the GASP MCP server, call lookup_metric({ "name": "Time to Patch" }) or generate_query({ "metric": "Time to Patch", "adapter": "<your adapter JSON>" }).

← Back to Engineering metrics