Patch Exposure Window Calculator
A monthly patch cycle feels disciplined, but attackers do not wait for your window. This calculator shows how cadence, testing and rollout combine into a time-to-patch figure and how many system-days of exposure follow once exploitation begins.
Your numbers
Days between scheduled patch windows.
From patch release to a tested package ready to deploy.
Time to reach all targets inside the window, including stragglers.
For actively exploited flaws this is often days, sometimes zero.
Servers or endpoints exposed to the vulnerability class.
Your results
Planning model. Actively exploited vulnerabilities should follow an emergency path, not the regular cycle.
Mean time to patch vs patch cycle interval
Sweeps Patch cycle interval from 7 to 120, holding your other inputs fixed.
Patch reporting review
Optional review of how you report patch exposure to leadership.
Optional. The tool and every export work without this. No spam.
How to use it
Enter your regular patch interval, how long testing and approvals take, and how long rollout lasts in practice. Add a realistic estimate of days between patch release and active exploitation for the vulnerability classes you worry about, such as remote code execution in VPNs or file transfer tools. The output gives mean and worst-case time to patch and the exposed system-days per year.
- Use observed deployment times from your patching tool, not the policy.
- Model emergency patches as a separate run with a short cycle.
- Remember OT and ERP hosts often patch far slower than office endpoints.
The formula
On average a patch waits half the cycle for the next window, so mean time to patch equals testing plus half the cycle plus rollout. The worst case waits a full cycle. Exposure after exploitation begins is the amount by which mean time to patch exceeds the days to exploit. Multiplying by the number of critical patches and systems gives annual exposed system-days, a simple trend metric to report.
Reading the sweep
The chart shows how time to patch grows with the cycle. Halving a 60 day cycle saves about fifteen days on average, which is often easier than shortening testing. If exposure stays high even at short cycles, the real constraint is testing or approval, and the fix is a faster emergency path for exploited flaws.
Common mistakes
Averages hide the stragglers: the machine that misses every window drives your real risk. Track the 90th percentile as well. Also separate internet-facing assets, which need days, from isolated plant floor systems where compensating controls such as segmentation and application allow-listing may justify longer cycles when patches risk stopping production.
Frequently Asked Questions
What is a good patch SLA for critical vulnerabilities?
Many programs target a few days for internet-facing systems with known exploitation and up to 30 days for others. Your risk appetite, change control and OT constraints decide the actual numbers.
How do I estimate days to exploitation?
Use threat intelligence such as exploited vulnerability catalogs and vendor advisories. For flaws already exploited at release, use zero. For others use a range and test sensitivity.
Should OT systems be patched on the same cycle?
Usually not. Patching can need vendor validation and downtime, so use compensating controls and a separate longer cycle, and document the exception and the controls that reduce exposure.
Is mean time to patch enough to report?
It is a start. Add percent of critical patches inside SLA and the age of the oldest unpatched critical item, since those expose stragglers that averages hide.
If patch status sits across ERP servers, MES hosts and spreadsheets, Netray can help build a private view that answers exposure questions without sending data outside.
Related Tools
Vulnerability Backlog Burn-Down Calculator
Model open findings against remediation capacity to see when the backlog clears and how many people you need to hit a target date.
ERP OperationsCyber Incident Dwell Time Cost Calculator
Price the days between intrusion and detection, and between detection and containment, then test what faster detection is worth.
Compliance & ContractsAnnualized Loss Expectancy Cyber Risk Calculator
Compute SLE, ALE and the net return of a security control so you can justify spend to finance in plain numbers.
Compliance & ContractsCyber Risk Register with ALE Worksheet
Log cyber risks for a plant or company, compute expected annual loss before and after controls, and export a ranked register to Excel.