On average, it takes an organization 15 times longer to close a vulnerability than it does for attackers to weaponize and exploit one. The 24/72 MTTH threshold is the next benchmark organizations need to achieve, testing and rolling out mitigations in an accelerated, yet methodical manner. Organizations that can achieve the 1/10/60 velocity are much more likely to maintain a sustainable advantage over their attackers and stay out of mainstream media headlines. The most advanced nation-state threat actors move laterally or break out from an initial beachhead within two hours.
Source: https://threatpost.com/mean-time-hardening-next-gen-security-metric/151402/