Vulnerability remediation timelines: how to set SLAs for clients

The short version: There is no universal deadline; the client's policy, contract or framework sets it. Base SLAs on exploitation and exposure, not severity alone. A common starting point: known explo