Most CISOs I work with track mean time to detect, mean time to respond, attacker dwell time.
Fewer track how long it takes their own organization to decide what to do about a known exposure.
That gap, between identification and decision, is where breaches take hold.
Gartner’s CTEM guidance explains why known exposures can remain open across multiple review cycles.
The issue is synchronization.
Remediation often requires security, IT, finance, and business owners to agree on operational impact, treatment, and ownership.
That cross-team mobilization takes time, especially when teams aren’t speaking the same language (financial and reputational impact) to achieve (1) budget allocation, and (2) remediate, mitigate or accept decisions.
The cost of delay has never been higher. Mandiant’s latest data shows that while as recently as 2022 cybersecurity teams had an average of 32 days to patch exploits, exploits today often occur before a patch exists.
Cybersecurity is faster than ever. Team KPIs need to reflect that.
TL;DR
Mean time-to-exploit has dropped to an estimated -7 days, while internal decision cycles still move in weeks.
Without a dollar figure, every exposure becomes a debate rather than a decision.
CoB × LoB converts each exposure to a dollar figure with a built-in disposition.
What Decision Velocity Actually Measures
Decision velocity is the internal latency between identifying a quantified exposure and committing to a course of action.
That is, to remediate, mitigate, or accept.
It is not MTTI (Mean Time to Identify) or MTTR (Mean Time to Remediate).
Decision velocity measures how quickly a security team can move a known exposure from "identified" to "acted upon."
The distinction matters because the bottleneck is not detection anymore.
Google Cloud / Mandiant’s M-Trends 2026 reports that mean time-to-exploit has dropped to an estimated -7 days. Exploitation is now routinely observed before a patch is released.
Google Threat Intelligence Group has also observed adversaries using AI to accelerate vulnerability research, exploit development, and other stages of the attack lifecycle.
The window has inverted.
AI is increasing the speed and scale at which attackers can work. Internal decision cycles cannot afford to run weeks behind an attacker who may already be moving well before a fix exists.
The offensive timeline has compressed accordingly. Unit 42 simulated a full attack cycle in 25 minutes using AI at every stage, a 100x compression from the observed median of two days (Unit 42, 2025). Anthropic’s red team documented working exploits produced in hours for vulnerabilities that expert penetration testers said would have taken weeks (Anthropic, 2026).
Organizations move slowly compared with the speed today’s threat environment demands.
In 2025, the full breach lifecycle lasted an average of 241 days (IBM 2025).
The decision cadence is still the quarterly vulnerability review cycle.
The average breach lifecycle runs almost 3 full quarters, while attackers are faster than ever.
Why Security Decisions Stay in Committee
76% of CISOs report being overwhelmed by the volume of threats across their environment (Cye CTEM Framework). The remediation queue is not the problem. The prioritization signal is.
Decision making speeds up when the inputs match the decision.
A CVSS score tells you how severe a vulnerability is technically. It doesn't tell the board what it costs if exploited, what closing it costs, or whether those two numbers justify the spend.
Without that translation, the security briefing can't produce a capital decision. It can only produce a request for more information.
That dollar figure must cover not only the immediate cost of fixing a breach, and the invoices you expect to come in as a result. It must consider lost pipeline, reputational damage, churned customers, and more.
Organizations that prioritize security investments based on a continuous exposure management program are three times less likely to suffer a breach by 2026 (Gartner, via Cye).
The key word here is "prioritizing". Not scanning more, not detecting faster. Simply making better decisions about what to act on first.
The point is, when every finding looks equally urgent, nothing moves. Better signals are the answer to faster decision making where it counts.
Few CFOs will approve a capital expenditure based on a severity rating.
A "7.2 out of 10" is just not speaking the CFO’s language.
But tell that same CFO that you’ve uncovered an expected loss of $4 million with a $35,000 remediation path; and you’ll not only be understood but very likely get the budget you need.
