Cyera: Why MTTR Is a Misleading Vulnerability Metric

Name: Cyera: Why MTTR Is a Misleading Vulnerability Metric
Uploaded: 2026-07-21T11:22:06-04:00
Duration: 58 s
Description: Every vulnerability program tracks MTTR. But it’s not measuring what you think. Wade Baker, co-founder of Cyentia Institute, on The Watchtower: https://youtu.be/mKkTgyvXqbw #CyberSecurity #Identity #CISO

Cyera

07/21/2026

0 (0%)

Report Like Favorite

TL;DR

MTTR only measures vulnerabilities that have been remediated — it completely ignores the open, unpatched vulnerabilities still present in the environment.
A program can achieve a strong MTTR score by fixing just 1% of vulnerabilities, while 99% remain exposed and exploitable.
Wade Baker of the Cyentia Institute calls MTTR misunderstood and misapplied, warning that what practitioners think it measures is not what it actually reflects.

Summary

In this short clip from The Watchtower, Wade Baker, co-founder of the Cyentia Institute, challenges one of the most widely used metrics in vulnerability management: Mean Time to Remediate (MTTR). Baker argues that MTTR is fundamentally misunderstood and misapplied across security programs because it only measures the vulnerabilities that teams actually close — not the full population of open, unpatched exposures sitting in the environment. The result is a metric that can look excellent on paper while 99% of vulnerabilities remain untouched and exploitable. Baker illustrates this with a pointed example: a program that fixes just 1% of its open vulnerabilities could still post an impressive MTTR score, creating a false sense of progress. His conclusion is direct — MTTR has limited usefulness, and what most practitioners believe it is telling them about program effectiveness is simply not accurate. Security leaders relying on MTTR as a primary measure of remediation velocity should reconsider what the metric actually captures and what it systematically ignores.

Chapters

0:00 - The MTTR Illusion
0:17 - What MTTR Actually Measures
0:46 - Misunderstood and Misapplied

Key Quotes

0:00 "You can have an extremely good MTTR by fixing 1% of the open vulnerabilities in your environment."
0:11 "Meanwhile, you've got 99% of the vulnerabilities that are untouched and open to exploitation."
0:35 "MTTR is only measuring the vulnerabilities that you remediate. It is not measuring all the vulnerabilities that are left open and unpatched, unfixed, unresolved."
0:46 "I think it is misunderstood and misapplied. It does have some usefulness, but what people think it's telling them is not it."

FAQ

Why is MTTR considered a vanity metric for vulnerability programs?

Because MTTR only calculates the average time to close vulnerabilities that were actually remediated. It excludes all open, unpatched vulnerabilities from the calculation, meaning a team can post a fast MTTR by selectively fixing a small fraction of issues while the majority of exposures remain unaddressed.

Does MTTR have any value at all?

Wade Baker acknowledges that MTTR has some usefulness, but cautions that it is widely misunderstood. The problem is not the metric itself but the assumption that it reflects overall remediation program effectiveness — which it does not.

Categories:

» Webinar Library » Cyera
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Illumio + Netskope: Zero Trust in the Age of AI Autonomy

Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

Becoming Agent Ready: Insights from Cyera's Expertise