Consider also time of introduction (of the vulnerability) to time of patch. We have now seen bugs that have been around for 4-5 years before being discovered

Consider also time of introduction (of the vulnerability) to time of patch. We have now seen bugs that have been around for 4-5 years before being discovered by ethical hackers and subsequently patched.