Software Defects Affecting Quality of Protection -- Time-to-Compromise Model for Cyber