Every metric names a moment. Mean time to detect names the moment a signal exists. Mean time to respond names the moment someone acts on it. In vulnerability management we lean on mean time to resolve, which names the moment the finding is gone. These are good words, and they have served the industry well. The trouble is not the words. It is what sits between the moments, and who does the work there.
Most of the hardest problems I’ve worked weren’t technical. They were standoffs between people who all wanted something reasonable and couldn’t get out of each other’s way. A corporate standard lands in a business unit. The business unit pushes back. Corporate digs in. From the outside it looks like a fight. It almost never is. The parties in that standoff are not opposed. Their interests are misaligned — which is a different thing, and a far more workable one.
In security, being correct is the floor, not the finish line. A finding can be technically right, fully defensible, and backed by the published rules — and still be the wrong thing to act on the way you acted on it. That gap is where a lot of hard-won credibility quietly drains away. I want to give that gap a name: the goodwill budget. It’s the standing willingness of everyone around you — engineers, customers, executives, partners — to keep saying yes to security when you ask.