A CySA+ analyst is building a monthly vulnerability management report for leadership. Executives want a single metric that demonstrates how effectively the security team is reducing the window of exposure between when a vulnerability is disclosed in the environment and when it is fully remediated. Which metric should the analyst report to best represent this goal?