CRA Remediation Metrics

What They Are

When vg scan --vulns runs inside a git repository, Vibgrate attributes every known vulnerability to the commit that introduced the affected version and measures how long you have been exposed. These exposure windows roll up into remediation metrics framed around the EU Cyber Resilience Act (CRA): they help you answer whether you are fixing things fast enough, with a number.

What Is Measured

• Exposure window — for each open advisory, the time from the commit that introduced the affected version to now.
• Open counts by severity — how many critical, high, moderate, and low advisories are currently open.
• Mean and maximum time exposed — across all attributed open advisories.
• SLA breaches — open advisories whose exposure exceeds a per-severity target. Defaults: critical 7 days, high 30, moderate 90, low 180.

Real Remediation Time (MTTR)

Beyond open exposure, Vibgrate reconstructs closed exposure windows from git history: a vulnerable version that was later bumped out of the affected range or removed from the lockfile entirely. The time from the introducing commit to that fix is a real remediation time, and the average across them is your actual mean time to remediate (MTTR) — measured from history, not estimated. Offline, a package-version manifest lets this include advisories that are fully fixed today, so a dependency that is clean now but was once vulnerable still counts toward your remediation record.

Not a Compliance Certification

These metrics are descriptive. They are framed around the CRA's expectation to remediate without undue delay so you can see whether remediation keeps pace — they are not a compliance certification or a legal attestation.

Where to See Them

The metrics are written into the scan artifact under the vulnerability results, and are available to AI assistants through the local vuln_attribution tool (see vg serve). Per-finding attribution also appears in vg why.

Distinguishing Absent from Zero

Attribution needs git history and a resolved lockfile. Where it is not available — for example a package with no lockfile timeline, or a non-git checkout — exposure is reported as unknown rather than zero. Vibgrate never fabricates a remediation number.