“If we know how long average time it takes to remediate cross-site scripting, then we have a much better way of knowing what we can expect when we come across these kinds of vulnerabilities.”

Transcript evidence from Mark Merkow — Secure, Resilient, and Agile Software Development.