Critical exposures hit your environment fast. Attackers exploit them in days, not months. You need vulnerability remediation SLAs that match real threats, not just scores.

Most teams still patch based on CVSS alone. That misses the point. Average fix times for high-risk flaws reached 55 days last year. Yet exploits start sooner. Smart SLAs balance severity, exploit odds, and your assets’ value. They cut noise and speed fixes.

This guide shows you how. Start with business context, then layer in threat data. Build policies that work across assets.

Assess Asset Criticality and Business Impact

Asset value sets the baseline for any SLA. A critical flaw on your customer database demands quicker action than one on a test server. CVSS gives severity, but it ignores your setup.

Look at data flows first. Does the asset hold PII? Serve public users? Tie to revenue systems? Rate assets high if downtime costs millions or regulators watch closely.

Business impact also matters. Map exposures to crown jewels, like Active Directory or e-commerce platforms. Internal systems get more time because segmentation limits blast radius.

For example, an identity exposure in your PAM system escalates automatically. It controls access everywhere. Fix it before a public-facing server flaw.

Use tiers to simplify. High-value assets trigger shorter SLAs. Low-value ones align with maintenance windows. This approach keeps teams focused.

Review asset inventories quarterly. Tools like CMDBs help. Adjust as cloud shifts or apps change.

Factor in Exploitability and Active Threats

CVSS stays static. Real risk changes with exploits. Use EPSS scores to predict attacks in the next 30 days. Scores above 0.25 put flaws in the top 5% for exploitation.

CISA’s KEV catalog flags actively exploited ones. As of April 2026, it lists over 1,400 entries. Federal deadlines run weeks. Match or beat them for critical items.

Combine scores. A CVSS 9.0 with EPSS under 0.1 waits. But KEV listing or proof-of-exploit drops timelines to hours.

Check EPSS user guide daily. It updates scores for 300,000+ CVEs. For KEV, download the CISA catalog CSV.

In practice, a SharePoint zero-day from April Patch Tuesday gets same-day mitigation if EPSS spikes. Ignore low EPSS on internal boxes.

Active threats override everything. Confirmed scans or alerts mean emergency response. Document exceptions, but keep them rare.

Build Your SLA Framework with Examples

Start simple. Base SLAs on risk tiers, not just severity. Tweak for context like exposure or exploits.

Here’s a starter framework. It covers common scenarios.

Risk Tier	Scenarios	Remediation SLA	Examples
Critical Fast-Track	Internet-facing criticals; KEV/EPSS >0.5; identity exposures	24-72 hours	Public API RCE; Active Directory flaws
High Priority	Internal criticals; cloud misconfigs on high-value assets	7-14 days	Segmented server CVSS 9+; S3 bucket exposures
Standard	Medium/high on low assets; no active exploits	30 days	Test env patches; config drifts
Review	Low severity; EPSS <0.01	90 days or next window	Legacy non-internet apps

This table sets clear ownership. Assign app teams for cloud, infra for servers. Automate where possible.

Test it. For a Log4j remnant on internet-facing servers, hit 24 hours. Internal ones get 14 days. Cloud IAM gaps on prod follow high priority.

See benchmarks in Qualys’ 2026 report. Top teams fix criticals under 30 days.

Roll out with stakeholder buy-in. Define metrics like MTTR per tier.

Implement SLAs Across Your Environment

Ticketing alone fails. Integrate SLAs into scanners and dashboards. Tools auto-tag by EPSS or asset group.

Set ownership rules. Security triages, owners remediate. Escalate misses weekly.

Exceptions need approval. Compensating controls count, like WAF blocks. Log them.

Train teams on scenarios. Run tabletop exercises for KEV adds.

Measure success. Track compliance rates. Aim for 90% on criticals. Adjust based on trends, like April 2026’s CVE surge.

Quarterly reviews keep SLAs fresh. New exploits or regs demand changes.

Secure.com outlines best practices that align here.

Key Takeaways for Strong Remediation SLAs

Risk-based SLAs beat severity-only ones. Balance CVSS, EPSS, KEV, and asset impact for timelines that fit your world.

Focus fixes where they count. Teams close gaps faster, attackers find less.

Start with the table above. Tweak for your assets. Track and iterate.

Need help building this? Book a Discovery Call with Bud Consulting to close skills gaps in vuln management.