and sometimes it takes a while to understand the true nature of a bug.
and sometimes the "right way" to fix something is unclear.
and sometimes the fix straddles multiple components, managed by different teams.
and sometimes "that guy" who knows the subsystem is off at Disneyland for two weeks.
60 days can pass very quickly, especially as the project and vulnerability complexity grows. It's a short enough window to put the vendor under time pressures from day one.
and sometimes the "right way" to fix something is unclear.
and sometimes the fix straddles multiple components, managed by different teams.
and sometimes "that guy" who knows the subsystem is off at Disneyland for two weeks.
60 days can pass very quickly, especially as the project and vulnerability complexity grows. It's a short enough window to put the vendor under time pressures from day one.