Rethinking Vulnerability Remediation as a Capacity Allocation Problem
2026-08-28 • Software Engineering
Software Engineering
AI summaryⓘ
The authors studied how fixing software vulnerabilities can be slowed down because too many issues pile up at once, making the speed of addressing them more important than just ranking which ones matter most. They found that many bug trackers are overwhelmed with tasks, and simple models can't predict fix times well. Their analyses suggest that managing workload like a flow of tasks and carefully allocating resources helps reduce delays, especially for the most critical bugs. They conclude that fixing vulnerabilities should be seen as managing flow and capacity, not just sorting by importance.
Vulnerability remediationFlow controlIssue trackerQueueing theoryCapacity allocationPriority rankingApache JiraBugzillaHeavy-tailed distributionSoftware vulnerabilities
Authors
Jana Stucke
Abstract
As AI accelerates vulnerability discovery, remediation throughput may become a greater constraint than prioritisation accuracy. This study evaluates vulnerability remediation as a flow-control problem using Apache Jira, Mozilla Bugzilla, Red Hat security errata, five public Jira organisations, and an npm dependency graph. Apache resolution times are strongly heavy-tailed, while 94-100% of arrivals in the primary issue trackers enter queues estimated to be at or above capacity. Queue-context models provide only moderate predictive discrimination and are largely matched by simple project-level baselines. Severity-to-speed discrimination varies substantially across systems. Flow-control analyses show larger operational effects: transitions from overloaded to draining queues are associated with shorter resolution times, severity-first sequencing reduces critical-item delay at fixed capacity, and capacity reservation can reduce prolonged critical-item delays. Owner-level analyses further show that available capacity is useful only when it is located where demand occurs or can be transferred through relevant expertise connections. These findings support treating vulnerability remediation as a flow-control and capacity-allocation problem rather than solely a ranking problem.