// GLOSSARY

MTTR (Mean Time To Remediate)

The average time from a finding being reported to the moment its closure is verified. When measuring the worth of security work, the count of findings is a misleading metric; because risk is reduced not by the vulnerability found but by the one closed. Reporting a hundred findings is an activity indicator, while how long those findings take to close is an outcome indicator. MTTR is this second dimension, the one that measures real effect, and its critical subtlety is in its definition: the duration measured must run not to the moment of 'said to be closed' but to the moment of 'verified as closed'. So MTTR rests on verifiable closure; otherwise the number turns into a misleading optimism adorned with vulnerabilities that are assumed closed but are not. It is tracked as a trend line in the rhythm of the Continuous Penetration Test: if the monthly average is falling, the organization's remediation reflex is quickening; if it is rising, a bottleneck is building. It is one of the core decision metrics of management visibility.