This first graph depicts the difference between the two method of releasing a patch. The "normal" method of releasing patches for vulnerabilities that have been responsibly disclosed is in purple. The quality of the patch increases at a linear rate, then once it is released to the community, as more people get involved with testing and improving the patch the quality increases exponentially.

Similarly, the quality of a patch publicly released as soon after the vulnerability announcement as possible will increase at the same rate (one of the assumptions), but without the initial linear growth. Thus, the quality of the patch should get better sooner.

This graph is just the inverse of the above. It depicts the risk an entity would face it they were to deploy the patch, and is necessary to calculate the risk later.

This is an idealised depiction of the number of vulnerable machines on the internet. With "normal" disclosure in purple, there is an initial plateau where the patch hasn't been released and thus noone can deploy it. After this the number of vulnerable machines starts to decrease exponentially as more people find out about the patch or complete their testing. This decrease is usually at a far slower rate than the rate of patch quality increase, thus this is not the same curve as the threat from a faulty patch.

The orange line represents patches released immediately. In this case patching would continue at the same rate (one of the assumptions). While both lines tend towards zero, in the real world they would probably taper and invert the curve as the die hard non-patchers (usually ignorant users) make their presence felt. However, this shouldn't make a difference on the final findings.

This graph depicts the growth rate of potential malicious threats. With normal patch release, the advisory and patch are usually synced to be released at the same time, even if they aren't a patch can be reverse engineered quite easily. Thus, the threats start increasing exponentially from then as more ha><0rs find out about the vulnerability and better exploits and attack tools are made and distributed. The threat is not non-zero before this though as skilled attackers could already know of the exploit.

In the case of non-responsibly disclosed vulnerabilities, or when the vendor releases the details straight away, the threats can start preparing straight away.

Risk is defined as the likelihood of a threat exploiting a vulnerability, or a threat being realised against a vulnerability. The actual consequences or impact of exploitation are only relevant if we look at one organisation, and can be ignored here. Thus, risk = threat x vulnerability. So, if we add the two threats together and multiply it by the vulnerability we can see that, initially the immediate patch release (orange) carries a higher risk, but this risk is reduced sooner. Delayed patch release (purple) has less risk initially, but prolongs the risk. In addition, the total risk of immediate patch release is less than that of delayed patch release (although the end of the purple curve is not shown it will decrease at the same rate the orange curve did, resulting in less surface area under the orange curve, than under the purple).