Elapsed time from a critical vulnerability being disclosed to it being remediated in production.
Median of (remediated − disclosed) for critical severity findings
Within 7 days for critical severity