Time-to-Patch Metrics: A Survival Analysis Approach Using Qualys and Elastic

This report describes applying survival analysis (Kaplan–Meier) to Qualys VMDR data in the Elastic Stack to produce more accurate time-to-patch metrics than traditional MTTR, explicitly handling censored (still-open) vulnerabilities and enabling stratified insights by severity, environment, and team. It covers Qualys agent configuration, data extraction via ES|QL and DSL into Python, and contrasts survival curves with CDFs for operational reporting; key observations include median remediation around 33–35 days with long-tail risk masked by averages and consistent results under a “patch everything” strategy. The authors recommend integrating these methods into routine reporting and tracking complementary metrics—arrival, burndown, and escape rates—to expose workload pressure, remediation throughput, and SLO escapes.