Quick reference
| Time | Step | What happens |
|---|---|---|
| T+0 | Report received | The clock starts and the reporter gets a ticket ID. |
| T+1 | Triaged | Severity set, owner assigned, duplicate checked. |
| T+2 | Reproduced | A failing test proves the bug before any fix. |
| T+4 | Patch shipped | The fix goes through the normal pipeline, not around it. |
| T+6 | Fix verified | The reporter confirms, or the regression test does. |
| T+10 | Closed | Postmortem filed; the lesson becomes a new test. |
Explained
T+0 and T+1 T+0: the report is received and the clock starts. The reporter gets a ticket ID, which is the difference between a report and a rumour. T+1: triage sets severity, assigns an owner and checks for a duplicate. This is where most programmes stall: the queue is real, but nobody owns the front of it.
T+2 and T+4 T+2: reproduction proves the bug with a failing test. Without it, the fix is a guess and verification has nothing to check. T+4: the patch ships through the normal pipeline. A hotfix that bypasses the tests is a second incident waiting for a quiet week.
T+6 and T+10 T+6: the reporter confirms, or the regression test does. If verification waits on the reporter, say so and set a date. T+10: close with a postmortem and a new test. The date is not the point; the test is what stops the same report arriving next quarter.
Why the clock Each timestamp gives one step a budget and a name. Without them, the only measured number is the total, and the total cannot tell you whether triage or verification is the problem.
The honest caveat: the times are a target, not a measurement. Track the median per step, or the timeline becomes a story you tell auditors.
The lesson: measure each step, because the total hides the queue.
In one line
The clock is the control. A timeline without owners is a wish list with dates.
Start the clock
date -u +%Y-%m-%dT%H:%M:%SZMore notes: Vulnerability management & attack surface
Open in the notes app: search, filters, copy This note on GitHub