Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW
  • CPE

Cyera: Why MTTR Is a Misleading Vulnerability Metric

Cyera
07/21/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


by fixing 1% of the open vulnerabilities in your environment. And the measurement would look like, wow, we're blowing it out. Meanwhile, you've got 99% of the vulnerabilities that are untouched and open to exploitation. Most people look at MTTR and they think it is a measure of how quickly the program is remediating or burning down vulnerabilities in their environment. And the faster, the better, right? That's the general consensus. But the thing is, the critical missing component is MTTR is only measuring the vulnerabilities that you remediate. It is not measuring all the vulnerabilities that are left open and unpatched, unfixed, unresolved. I think it is misunderstood and misapplied. It does have some usefulness, but what people think it's telling them is not it.

TL;DR

  • MTTR only measures vulnerabilities that have been remediated — it completely ignores the open, unpatched vulnerabilities still present in the environment.
  • A program can achieve a strong MTTR score by fixing just 1% of vulnerabilities, while 99% remain exposed and exploitable.
  • Wade Baker of the Cyentia Institute calls MTTR misunderstood and misapplied, warning that what practitioners think it measures is not what it actually reflects.

Summary

In this short clip from The Watchtower, Wade Baker, co-founder of the Cyentia Institute, challenges one of the most widely used metrics in vulnerability management: Mean Time to Remediate (MTTR). Baker argues that MTTR is fundamentally misunderstood and misapplied across security programs because it only measures the vulnerabilities that teams actually close — not the full population of open, unpatched exposures sitting in the environment. The result is a metric that can look excellent on paper while 99% of vulnerabilities remain untouched and exploitable. Baker illustrates this with a pointed example: a program that fixes just 1% of its open vulnerabilities could still post an impressive MTTR score, creating a false sense of progress. His conclusion is direct — MTTR has limited usefulness, and what most practitioners believe it is telling them about program effectiveness is simply not accurate. Security leaders relying on MTTR as a primary measure of remediation velocity should reconsider what the metric actually captures and what it systematically ignores.

Chapters

0:00 - The MTTR Illusion
0:17 - What MTTR Actually Measures
0:46 - Misunderstood and Misapplied

Key Quotes

0:00 "You can have an extremely good MTTR by fixing 1% of the open vulnerabilities in your environment."
0:11 "Meanwhile, you've got 99% of the vulnerabilities that are untouched and open to exploitation."
0:35 "MTTR is only measuring the vulnerabilities that you remediate. It is not measuring all the vulnerabilities that are left open and unpatched, unfixed, unresolved."
0:46 "I think it is misunderstood and misapplied. It does have some usefulness, but what people think it's telling them is not it."

FAQ

Why is MTTR considered a vanity metric for vulnerability programs?

Because MTTR only calculates the average time to close vulnerabilities that were actually remediated. It excludes all open, unpatched vulnerabilities from the calculation, meaning a team can post a fast MTTR by selectively fixing a small fraction of issues while the majority of exposures remain unaddressed.

Does MTTR have any value at all?

Wade Baker acknowledges that MTTR has some usefulness, but cautions that it is widely misunderstood. The problem is not the metric itself but the assumption that it reflects overall remediation program effectiveness — which it does not.


Categories:
  • » Webinar Library » Cyera
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Vulnerability Management
  • Security Operations
  • Thought Leadership
  • short_form
  • Executive Briefing
  • MTTR
  • Security Metrics
  • Remediation Programs
  • Risk Measurement
  • CISO Strategy
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Cyera: Why MTTR Is a Misleading Vulnerability Metric

              View CPE Certificates

              Upcoming 360 View Events

              • Nov
                19

                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Oct
                  27

                  Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

                  10/27/202611:00 AM ET
                  • Oct
                    28

                    EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

                    10/28/202601:00 PM ET
                    • Nov
                      10

                      Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

                      11/10/202601:00 PM ET
                      • Nov
                        12

                        Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

                        11/12/202601:00 PM ET
                        More events

                        Industry Events (Sponsor Hosted)

                        • Oct
                          27

                          Maximize Security, Value, and Profit from Your Microsoft Investment

                          10/27/202611:00 AM ET
                          • Oct
                            27

                            The HUMAN Experience: Real-Time Insights into Page Intelligence

                            10/27/202601:00 PM ET
                            • Oct
                              28

                              Ensuring AI Security Across the APAC Region

                              10/28/202601:00 AM ET
                              • Oct
                                28

                                EMEA: Ensuring Comprehensive AI Security Across All Platforms

                                10/28/202606:00 AM ET
                                • Oct
                                  28

                                  AMERICAS: Safeguarding AI Across All Fronts

                                  10/28/202601:00 PM ET
                                  More events

                                  Upcoming Webinar Calendar

                                  • 10/27/2026
                                    11:00 AM
                                    10/27/2026
                                    Maximize Security, Value, and Profit from Your Microsoft Investment
                                    https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-profit-from-your-microsoft-investment/
                                  • 10/27/2026
                                    11:00 AM
                                    10/27/2026
                                    Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action
                                    https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
                                  • 10/27/2026
                                    01:00 PM
                                    10/27/2026
                                    The HUMAN Experience: Real-Time Insights into Page Intelligence
                                    https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
                                  • 10/28/2026
                                    01:00 AM
                                    10/28/2026
                                    Ensuring AI Security Across the APAC Region
                                    https://www.truthinit.com/index.php/channel/2125/ensuring-ai-security-across-the-apac-region/
                                  • 10/28/2026
                                    06:00 AM
                                    10/28/2026
                                    EMEA: Ensuring Comprehensive AI Security Across All Platforms
                                    https://www.truthinit.com/index.php/channel/2127/emea-ensuring-comprehensive-ai-security-across-all-platforms/
                                  • 10/28/2026
                                    01:00 PM
                                    10/28/2026
                                    AMERICAS: Safeguarding AI Across All Fronts
                                    https://www.truthinit.com/index.php/channel/2126/americas-safeguarding-ai-across-all-fronts/
                                  • 10/28/2026
                                    01:00 PM
                                    10/28/2026
                                    EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure
                                    https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
                                  • 11/04/2026
                                    11:00 AM
                                    11/04/2026
                                    Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions
                                    https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
                                  • 11/05/2026
                                    02:00 PM
                                    11/05/2026
                                    HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.
                                    https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
                                  • 11/05/2026
                                    02:00 PM
                                    11/05/2026
                                    Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                                    https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                                  • 11/10/2026
                                    01:00 PM
                                    11/10/2026
                                    Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service
                                    https://www.truthinit.com/index.php/channel/2191/zendesk-from-ai-readiness-to-results-a-framework-for-transforming-it-service/
                                  • 11/12/2026
                                    01:00 PM
                                    11/12/2026
                                    Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision
                                    https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
                                  • 11/19/2026
                                    01:00 PM
                                    11/19/2026
                                    Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection
                                    https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
                                  • 11/19/2026
                                    01:00 PM
                                    11/19/2026
                                    Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                                    https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                                  Truth in IT
                                  • Sponsor
                                  • About Us
                                  • Terms of Service
                                  • Privacy Policy
                                  • Contact Us
                                  • Preference Management
                                  Desktop version
                                  Standard version