Rethinking Vulnerability Remediation as a Capacity Allocation Problem

Abstract

As AI accelerates vulnerability discovery, remediation throughput may become a greater constraint than prioritisation accuracy. This study evaluates vulnerability remediation as a flow-control problem using Apache Jira, Mozilla Bugzilla, Red Hat security errata, five public Jira organisations, and an npm dependency graph. Apache resolution times are strongly heavy-tailed, while 94-100% of arrivals in the primary issue trackers enter queues estimated to be at or above capacity. Queue-context models provide only moderate predictive discrimination and are largely matched by simple project-level baselines. Severity-to-speed discrimination varies substantially across systems. Flow-control analyses show larger operational effects: transitions from overloaded to draining queues are associated with shorter resolution times, severity-first sequencing reduces critical-item delay at fixed capacity, and capacity reservation can reduce prolonged critical-item delays. Owner-level analyses further show that available capacity is useful only when it is located where demand occurs or can be transferred through relevant expertise connections. These findings support treating vulnerability remediation as a flow-control and capacity-allocation problem rather than solely a ranking problem.