## 6 Methods of Evaluation for Vulnerability Mitigation Models  
To assess the effectiveness of the vulnerability management models proposed in the previous chapter (Figure 1) a time metric introduced in [43] and extended in [41] has been considered. In [43], the authors interviewed engineers responsible for vulnerability mitigation and classified vulnerability mitigation steps into the following categories:  
* From 1 to 3 h (configuration),
* From 3 to 6 h (fix by software version update),
* From 6 to 9 h (fix by operating system update). It should be noted that the correlation between the severity of the vulnerability and the required time could differ for different organizations. The time required for developers mitigating vulnerability might be unique; hence, the following calculations do not involve cases where no official patching, or other mitigation process, is recommended. Based on previously introduced work time ranges, the vulnerability fix time (\(T_{FIX}\)) was divided into three subcategories:  
* \(T_{FIX_{MAX}}\)--addressing maximum time effort, in hours (9 h), required to fix vulnerability,
* \(T_{FIX_{AVERGE}}\)--addressing average time effort, in hours (4.5 h), required to fix vulnerability,
* \(T_{FIX_{MIN}}\)--addressing minimum time effort, in hours (1 h), required to fix vulnerability,  
Those time ranges would provide additional information regarding possible time ranges when fixing vulnerabilities, based on those additional calculations performed, addressing effort in time for the ICT administrator. Assuming that administrators must fix all vulnerabilities with critical (\(X_{C}\)), high (\(X_{H}\)) and medium (\(X_{M}\)) classification, the time required for mitigation vulnerabilities can be expressed as the sum of the number of vulnerabilities to be fixed and the corresponding number of work hours. In addition, the scan duration \(T_{S}\) should also be taken into account. Taking into account all the contributing terms for the CVSS v2.0 base score, the relevant equation is the following. \[T_{\text{base2}}=T_{S}+(T_{FIX}\cdot X_{H_{\text{CVSS v2.0 base}}})+(T_{FIX}\cdot X_{M_{\text{CVSS v2.0 base}}}) \tag{1}\]  
\(T_{FIX}\) is the number of work hours required to fix one vulnerability, while \(X_{H_{\text{CVSS v2.0 base}}}\) and \(X_{M_{\text{CVSS v2.0 base}}}\) indicate the number of vulnerabilities with, respectively, high and medium severity level, according to the CVSS v2.0 base score. In an analogous manner for CVSS v3.x, the following equation was obtained:  
\[T_{\text{base3}}=T_{S}+(T_{FIX}\cdot X_{C_{\text{CVSS v3.x base}}})+(T_{FIX} \cdot X_{H_{\text{CVSS v3.x base}}})+(T_{FIX}\cdot X_{M_{\text{CVSS v3.x base}}}) \tag{2}\]  
where \(X_{C_{\text{CVSS v3.x base}}}\) is the number of critical vulnerabilities. \(X_{C_{\text{CVSS v3.x base}}}\)\(X_{H_{\text{CVSS v3.x base}}}\), \(X_{M_{\text{CVSS v3.x base}}}\) denote, respectively, the number of vulnerabilities with a critical, high, and medium severity level, according to the CVSS v3.x base score. As the CVSS base score relates to a subjective assessment performed outside of the organization, it is possible that the low severity category (\(X_{L}\)) includes vulnerabilities that are underestimated. Therefore, administrators should include all vulnerabilities in the mitigation process, in order to exclude the risk of omitting a vulnerability with an underestimated assessment [49; 53]. The modified equation for the model with the CVSS v2.0 base score, which minimizes the risk in case an underestimated vulnerability is not fixed, is expressed as follows:  
\[T_{base2^{\prime}}=T_{S}+(T_{FIX}\cdot X_{H_{\text{CVSS v2.0 base}}})+(T_{FIX} \cdot X_{M_{\text{CVSS v3.20 base}}})+(T_{FIX}\cdot X_{L_{\text{CVSS v2.0 base}}}) \tag{3}\]  
\(T_{FIX}\) denotes the work hours required to fix one vulnerability, while \(X_{H_{\text{CVSS v2.0 base}}}\), \(X_{M_{\text{CVSS v2.0 base}}}\), \(X_{L_{\text{CVSS v2.0 base}}}\) indicate a number of vulnerabilities with high, medium and low severity level, respectively, according to the CVSS v2.0 base score.