Remediation Delay Dataset v2026.1
Six-year remediation delay trend data (2020–2026) across 7 industries and 4,721 programmes
Data Preview — 6-Year Trend by Industry
| industry | days_2026 | days_2024 | days_2022 | days_2020 | trend | sample_size |
|---|---|---|---|---|---|---|
| fintech | 6.2d | 6.8d | 8.1d | 10.2d | improving | 810 |
| saas | 5.4d | 5.7d | 7d | 9.1d | improving | 920 |
| financial_services | 8.3d | 8d | 9.2d | 11.4d | worsening | 480 |
| healthcare | 8.8d | 9d | 10.1d | 12.3d | improving | 560 |
| ecommerce | 7.8d | 8d | 9.4d | 11.8d | improving | 620 |
| retail | 9.1d | 8.4d | 9d | 11d | worsening | 540 |
| hospitality | 10.4d | 9.9d | 10.8d | 12.9d | worsening | 310 |
Download & Access
Download CSV
Full 6-year trend dataset as CSV with yearly columns and anonymised records.
Download CSVFrequently Asked Questions
What does remediation delay mean in this dataset?
Remediation delay is the number of calendar days from gap identification (via assessment or continuous monitoring) to verified closure (evidence accepted by QSA or automated control check). It excludes time before gap detection.
Why is Hospitality the slowest industry for remediation?
Hospitality has the lowest automation adoption (35%) of any tracked industry, fragmented property-level IT environments, high staff turnover affecting compliance knowledge, and limited in-house security expertise. These factors combine to produce the longest average remediation time at 10.4 days.
What is the best-in-class remediation time?
Top-decile (P90) performers across all industries achieve 3.8 days average remediation. In SaaS, the top-quartile achieves sub-3-day remediation through automated evidence pipelines and pre-built remediation playbooks.