Response SLA

Last updated: Oct 1, 2026

---

Description

At least 90% of reattack requests, comments, events and incidents will receive a first response in a median time of less than 8 office hours.

Criteria

This service-level agreement (SLA) indicator applies only when these conditions are true:

• Your group must have the Advanced plan.
• Fluid Attacks must have access to the source code and to its related environment.
• Remote access must work without human intervention (for example, no CAPTCHA or OTP).
• There are more than 500 reattack requests, comments, or incident reports.

Details

Together with the general measurement aspects, Fluid Attacks measures this SLA indicator with these rules:

• Fluid Attacks calculates the percentages with percentiles.
• Office hours are from 7 a.m. to 7 p.m. UTC-5 on business days, twelve hours each day.
• The calculation includes only the reattacks on vulnerabilities that the platform reports as closed.

Indicator calculation

To calculate the response indicator, do these steps:

1. For each vulnerability, calculate the response time of the last reattack that closed the vulnerability. That is, the reattack changed the status of the vulnerability from Vulnerable to Safe. If the vulnerability closed without a previous reattack request, count it as a reattack with a response time of 0. Do not include in the calculation the vulnerabilities with these closing reasons: Root moved to another group, root or environment deactivated, and exclusion.
2. Calculate the response times of the incidents that clients report to [email protected].
3. Calculate the response time of each comment in the weakness section.
4. Calculate the response time of each comment on an event.
5. Calculate the response time of each verification request on an event:
   • Measure the time from the verification request to the answer. The answer verifies the event as solved or as unsolved.
   • If Fluid Attacks closed the event without a verification request, give it a response time of 0.
6. Put the response times from steps 1, 2, 3, 4, and 5 into one dataset.
7. Remove the top decile (top 10%) of the response times. Then calculate the median of the remaining values.