Remediation-Time Model

A calibrated estimate of how long a finding will take to close — and an honest account of where the model breaks.

Planned

Problem: Planning remediation capacity means guessing which findings will drag. Severity is a weak proxy: some criticals are a one-line patch, some mediums need a vendor and a change window.
Approach: Supervised learning on a synthetic findings dataset — gradient-boosted trees and logistic regression — predicting whether a finding closes within its SLA. Full treatment of class imbalance, probability calibration, and feature leakage.
Result: A model card that states accuracy, calibration, and the conditions under which the estimate should not be trusted — the part most write-ups skip.

What it will show

The unglamorous 80%: leakage checks, train/test discipline, calibration curves, and a confusion matrix read in plain language.
Feature importance tied back to something actionable, not just ranked bars.
A written limitations section with teeth — synthetic data ceilings, drift, and why a good AUC still doesn’t mean “deploy this”.

Synthetic findings data with plausible structure. The point is the method, not a benchmark number.

Planned.