When a critical vulnerability lands, one of the first questions asked is how long you have to fix it. The truth is, there’s no one answer. Your auditors may have one expectation, customer contracts may have another, and regulators can impose different requirements depending on yo