43 days, 26 percent, and a pitch that saves you 29 minutes

A median is not a deadline. Half the resolutions in that sample landed later than 43 days ^[1], and the 26% figure is a stock rather than a rate: it counts how much of the CISA catalogue stood closed at survey time across 13,000 organizations ^[2]. Subtract, and roughly three quarters of those critical entries were open ^[5]. The two numbers describe separate failures, one a clock and one a backlog the clock never reaches.

The explanation offered for the backlog is not analyst throughput. The piece points at third-party software the organization does not control, and at proprietary applications too fragile or too operationally critical to patch quickly ^[6]. It names the interval between knowing and fixing the remediation gap ^[7]. Google's Jon Ramsey and Payal Chakravarty say the same thing in the blog post the article draws on: some applications cannot be patched, and remediation takes time regardless ^[4]. Nothing on that list is a SOC purchase.

Now the arithmetic nobody in the pitch performs. The headline productivity claim is a half-hour investigation completed in one minute ^[10]. Take it at face value: 29 minutes saved. The exposure window it sits inside is 61,920 minutes long ^[11], so the saving is about 0.05% of the median time an organization stays exploitable on a vulnerability it already knows about ^[12]. Triage speed and remediation speed are separate accounts, and the report's numbers are entries in the second one.

What survives that is the compensating-control argument, which is the honest part of the case. Google AI Threat Defense with Security Operations agents is presented as an always-on layer around systems that stay exposed because they cannot be patched yet ^[18]. The Detection Engineering agent is described as pulling threat intelligence, offensive-tool repositories, red- and purple-team reports, malware analysis and internal telemetry to find coverage gaps and write rules against them ^[8], and validating a suspected vulnerability by firing synthetic attack events at it before a real exploit arrives ^[9]. That does not shorten the 43 days. It tries to make the 43 days watched. The retrospective hunting agent ^[14] and the supervised containment playbooks ^[15] run on the same logic: assume the hole is still there.

One caveat on provenance. Our material for both DBIR figures is a resource page on scworld.com citing a recent Google blog post ^[17]. The definitions carry the weight here, "full resolution" in particular, and we have not seen the report state what it counted.