Patch Management SLA Backlog Calculator

What SLA windows are actually standard?

CISA's Binding Operational Directive 22-01 requires federal agencies to remediate known exploited vulnerabilities within a set window, and most enterprise vulnerability management policies mirror or tighten that with roughly 15 days for critical, 30 for high, 60-90 for medium, and 90-180 for low severity, though regulated industries like finance and healthcare often run tighter timelines.

My backlog is growing even though we're patching every week, what's going on?

This is the most common vulnerability management failure mode: your remediation rate is a fixed capacity (people, change windows, testing cycles) while new vulnerability disclosure volume keeps climbing industry-wide. The fix is either increasing remediation throughput through automation and pre-approved patch windows, or reducing attack surface so fewer systems generate new findings in the first place.

Should every vulnerability actually get patched?

No, mature programs risk-score and often accept or compensate for vulnerabilities that aren't internet-facing, don't have known exploits, or sit behind other controls, rather than treating every scanner finding as equal. Applying that filtering before counting your backlog gives a far more realistic and achievable throughput target than trying to patch everything.

How much does automation actually move the remediation rate?

Organizations moving from manual patch testing and deployment to automated patch management with staged rollout groups commonly see remediation throughput increase 40-70%, mainly by cutting the manual scheduling and verification overhead that dominates patch cycle time more than the actual patching work itself.