Larger organisations take over a month longer (61 days) than smaller ones (27 days) to resolve serious findings in pentests.