# Patch Exposure Window Calculator

> Source: https://netray.co/tools/patch-exposure-window-calculator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Quantify how many system-days per year you remain exposed after a critical vulnerability is exploited, based on your patch cadence.

## Category

erp-operations

## Industry

Manufacturing

## Audience

- IT security lead
- Systems administrator
- Plant IT

## Tool

**Kind:** calculator

**Inputs:**

#### Patch cycle interval

**Key:** patch_cycle

**Type:** slider

**Default:** 30

**Min:** 7

**Max:** 120

**Step:** 1

**Unit:** days

**Help:** Days between scheduled patch windows.

#### Testing and approval time

**Key:** test_days

**Type:** number

**Default:** 7

**Min:** 0

**Step:** 1

**Unit:** days

**Help:** From patch release to a tested package ready to deploy.

#### Rollout duration

**Key:** rollout_days

**Type:** number

**Default:** 5

**Min:** 0

**Step:** 1

**Unit:** days

**Help:** Time to reach all targets inside the window, including stragglers.

#### Days from release to active exploitation

**Key:** exploit_days

**Type:** number

**Default:** 10

**Min:** 0

**Step:** 1

**Unit:** days

**Help:** For actively exploited flaws this is often days, sometimes zero.

#### Critical patches per year

**Key:** critical_per_year

**Type:** number

**Default:** 24

**Min:** 0

**Step:** 1

#### Systems in scope

**Key:** systems

**Type:** number

**Default:** 150

**Min:** 0

**Step:** 5

**Help:** Servers or endpoints exposed to the vulnerability class.

**Outputs:**

#### Mean time to patch

**Key:** mttp

**Expr:** test_days + patch_cycle / 2 + rollout_days

**Format:** days

**Primary:** true

**Description:** Average wait for the next window is half the cycle.

#### Worst-case time to patch

**Key:** worst

**Expr:** test_days + patch_cycle + rollout_days

**Format:** days

#### Average exposed days after exploitation starts

**Key:** exposure_days

**Expr:** max(mttp - exploit_days, 0)

**Format:** days

#### Exposed system-days per year

**Key:** system_days

**Expr:** critical_per_year * systems * exposure_days

**Format:** number

**Primary:** true

#### Share of time spent exposed per patch

**Key:** per_patch

**Expr:** if(gt(mttp, 0), exposure_days / mttp * 100, 0)

**Format:** percent

**Chart:**

#### Mean time to patch vs patch cycle interval

**Type:** line

**X:** patch_cycle

**From:** 7

**To:** 120

**Steps:** 25

**Series:**

- mttp
- worst

**Disclaimer:** Planning model. Actively exploited vulnerabilities should follow an emergency path, not the regular cycle.

## Content

**Intro:** A monthly patch cycle feels disciplined, but attackers do not wait for your window. This calculator shows how cadence, testing and rollout combine into a time-to-patch figure and how many system-days of exposure follow once exploitation begins.

**Sections:**

#### How to use it

**Body:** Enter your regular patch interval, how long testing and approvals take, and how long rollout lasts in practice. Add a realistic estimate of days between patch release and active exploitation for the vulnerability classes you worry about, such as remote code execution in VPNs or file transfer tools. The output gives mean and worst-case time to patch and the exposed system-days per year.

**Bullets:**

- Use observed deployment times from your patching tool, not the policy.
- Model emergency patches as a separate run with a short cycle.
- Remember OT and ERP hosts often patch far slower than office endpoints.

#### The formula

**Body:** On average a patch waits half the cycle for the next window, so mean time to patch equals testing plus half the cycle plus rollout. The worst case waits a full cycle. Exposure after exploitation begins is the amount by which mean time to patch exceeds the days to exploit. Multiplying by the number of critical patches and systems gives annual exposed system-days, a simple trend metric to report.

#### Reading the sweep

**Body:** The chart shows how time to patch grows with the cycle. Halving a 60 day cycle saves about fifteen days on average, which is often easier than shortening testing. If exposure stays high even at short cycles, the real constraint is testing or approval, and the fix is a faster emergency path for exploited flaws.

#### Common mistakes

**Body:** Averages hide the stragglers: the machine that misses every window drives your real risk. Track the 90th percentile as well. Also separate internet-facing assets, which need days, from isolated plant floor systems where compensating controls such as segmentation and application allow-listing may justify longer cycles when patches risk stopping production.

**Cta:** If patch status sits across ERP servers, MES hosts and spreadsheets, Netray can help build a private view that answers exposure questions without sending data outside.

**Faq:**

#### What is a good patch SLA for critical vulnerabilities?

**Answer:** Many programs target a few days for internet-facing systems with known exploitation and up to 30 days for others. Your risk appetite, change control and OT constraints decide the actual numbers.

#### How do I estimate days to exploitation?

**Answer:** Use threat intelligence such as exploited vulnerability catalogs and vendor advisories. For flaws already exploited at release, use zero. For others use a range and test sensitivity.

#### Should OT systems be patched on the same cycle?

**Answer:** Usually not. Patching can need vendor validation and downtime, so use compensating controls and a separate longer cycle, and document the exception and the controls that reduce exposure.

#### Is mean time to patch enough to report?

**Answer:** It is a start. Add percent of critical patches inside SLA and the age of the oldest unpatched critical item, since those expose stragglers that averages hide.

## Search terms

patch exposure window calculator, mean time to patch calculator, patch cadence risk, critical patch sla calculator, time to exploit vs time to patch, patch management manufacturing, vulnerability exposure days

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json