Mean Time to Remediate Is Not a Fielding Model: A Cadence Audit for Enterprise Vulnerability Management

• URL: http://arxiv.org/abs/2607.04511v1
• Date: Sun, 05 Jul 2026 21:23:26 GMT
• Title: Mean Time to Remediate Is Not a Fielding Model: A Cadence Audit for Enterprise Vulnerability Management
• Abstract summary: This paper introduces a remediation-cadence audit for enterprise vulnerability management.<n>It records routine mean lag, release period, release fraction, cohort geometry, emergency/routine split, non-fielding delay, local residual-pressure evidence, and declared rate scenario.
• Score: 51.56484100374058
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Enterprise security teams commonly summarize remediation through mean time to remediate (MTTR), SLA compliance, dwell time, or detection delay. These metrics are useful, but they can hide how fixes actually reach the estate: continuously, through scheduled maintenance windows, in deployment rings, or through emergency bypass paths. This paper introduces a remediation-cadence audit for enterprise vulnerability management. The audit records routine mean lag, release period, release fraction, cohort geometry, emergency/routine split, non-fielding delay, local residual-pressure evidence, and declared rate scenario. It compares a continuous same-mean shortcut with the recorded release calendar and reports a local capacity verdict plus a calendar discount: the fraction of mean-only local capacity consumed by calendarized fielding. Worked notional packets with the same 30-day mean lag show why this matters. Under the normalized screening scenario, a two-month release train consumes 17.4\% of mean-only capacity, a monthly train 5.2\%, and a two-week screen 1.3\%; across a 16-fold attacker-adjustment rate band, the two-month discount remains at least about 12\% and the monthly discount stays in the resolution-sensitive 3--8\% range. The audit therefore turns cadence assessment into an evidence-resolution question: when the discount is material relative to residual-pressure uncertainty or claimed headroom, MTTR/SLA should not be used alone as fielding evidence. Release-geometry checks show that deployment rings do not automatically recover the continuous benchmark, and cohort staggering can help or hurt near capacity. The result is a reproducible governance diagnostic, not a breach predictor or CVE prioritizer.

Related papers

• From Subjective Judgments to Auditable Standards:Protocol-Guided AI Auditing of Website Redundancy [2.2917707112773593]
  Website redundancy does not have a single fixed meaning.<n>We introduce CORA, which measures repetition load, normal-use tax, and failure-domain recovery reserve separately.
  arXiv  Detail & Related papers  (2026-08-21T07:17:35Z)
• Residual Dominance as a Structural Account of Last-Item Reliance in Causal Self-Attention Recommenders [47.8060666024071]
  We show that SASRec-style models exhibit highly localized last-item reliance.<n>We then find that residual addition sharply shifts the full-block representation toward same-position contributions.<n>Changing the residual strength induces a monotonic trade-off between structural mixing and last-item reliance.
  arXiv  Detail & Related papers  (2026-08-14T07:09:58Z)
• Conformalized Large Language Models under Configuration Shift [46.502741608809174]
  Conformal prediction is a distribution-free framework for uncertainty quantification.<n>Nonconformity scores are often induced by an inference pipeline, not just a fixed model.<n>We show that configuration shift consistently erodes CP validity.
  arXiv  Detail & Related papers  (2026-08-02T19:34:41Z)
• SVR: Self-Verifying Refinement via Joint Verdict-Confidence Reinforcement Learning for Adaptive Test-Time Compute [62.3458279176813]
  Self-Verifying Refinement is an oracle-free multi-turn reinforcement learning framework.<n>It learns to use self-verification as a compute-control policy.<n>It achieves a macro-average accuracy of 0.563 with only 2.99 inference turns on average.
  arXiv  Detail & Related papers  (2026-07-30T16:20:58Z)
• Certified World Models as Sensing Clocks: Drift-Aware Deadlines for Active Perception [6.230579198456525]
  We turn a validity horizon into an operational sensing clock.<n>On a frozen 3D VN-JEPA model, the resulting clock controls held-out interval-simultaneous certificate violation.<n>We also report limits: in the short-horizon frozen VN-JEPA regime, empirical conformal horizons match the deployed clock on validity and budget, and a partial-reset exploration finds no clean budget-matched advantage for the spectral term.
  arXiv  Detail & Related papers  (2026-07-01T23:36:49Z)
• Causal Label Recovery in Payment Networks [0.0]
  Fraud detection models in payment networks train on chargeback labels that are systematically biased.<n>A companion paper [arXiv05:26.27557] proved that these four impairments impose a minimax lower bound on detection performance.<n>We formalize the observation pipeline as a sequential missing-data problem with three stages and a corruption layer, and construct the Sequential Triply Robust estimator.
  arXiv  Detail & Related papers  (2026-05-28T02:43:34Z)
• A Benchmark for Strategic Auditee Gaming Under Continuous Compliance Monitoring [1.253312107729806]
  Continuous post-deployment compliance audits create a class of strategic gaming.<n>We formalize continuous auditing as a $T$-round Stackelberg game between an auditor that commits to a temporal policy and an adaptive auditee.
  arXiv  Detail & Related papers  (2026-05-07T14:28:34Z)
• Affordance Agent Harness: Verification-Gated Skill Orchestration [45.231685718099264]
  Affordance grounding requires identifying where and how an agent should interact in open-world scenes.<n>We propose Affordance Agent Harness, a closed-loop runtime that unifies skills with an evidence store and cost control.
  arXiv  Detail & Related papers  (2026-05-01T13:45:16Z)
• The Confidence Gate Theorem: When Should Ranked Decision Systems Abstain? [0.0]
  Ranked decision systems must decide when to intervene in ranked outputs and when to abstain.<n>We study when confidence-based abstention monotonically improves decision quality, and when it fails.
  arXiv  Detail & Related papers  (2026-03-10T17:44:10Z)
• Improving Search Agent with One Line of Code [68.58667107354253]
  Tool-based Agentic Reinforcement Learning (TARL) has emerged as a promising paradigm for training search agents to interact with external tools.<n>We propose textbfSearch textbfAgent textbfPolicy textbfOptimization (textbfSAPO), which stabilizes training via a conditional token-level KL constraint.
  arXiv  Detail & Related papers  (2026-03-10T04:07:39Z)
• Tempora: Characterising the Time-Contingent Utility of Online Test-Time Adaptation [16.841308606553685]
  Test-time adaptation (TTA) offers a compelling remedy for machine learning (ML) models that degrade under domain shifts.<n>Traditional evaluations assume unbounded processing time, overlooking the accuracy-latency trade-off.<n>We introduce Tempora, a framework for evaluating TTA under temporal pressure.
  arXiv  Detail & Related papers  (2026-02-05T19:10:53Z)
• TARG: Training-Free Adaptive Retrieval Gating for Efficient RAG [46.122203287541005]
  Training-free Adaptive Retrieval Gating (TARG) is a single-shot policy that decides when to retrieve using only a short, no-latency draft from the base model.<n>On NQ-Open, TriviaQA, and PopQA, TARG consistently shifts the accuracy-efficiency frontier.
  arXiv  Detail & Related papers  (2025-11-12T23:09:52Z)
• Uncertainty-aware Unsupervised Multi-Object Tracking [33.53331700312752]
  unsupervised multi-object trackers are inferior to learning reliable feature embeddings. Recent self-supervised techniques are adopted, whereas they failed to capture temporal relations. This paper argues that though the uncertainty problem is inevitable, it is possible to leverage the uncertainty itself to improve the learned consistency in turn.
  arXiv  Detail & Related papers  (2023-07-28T09:03:06Z)
• Continual Test-Time Domain Adaptation [94.51284735268597]
  Test-time domain adaptation aims to adapt a source pre-trained model to a target domain without using any source data. CoTTA is easy to implement and can be readily incorporated in off-the-shelf pre-trained models.
  arXiv  Detail & Related papers  (2022-03-25T11:42:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.