Dwell Time
Definition
The period between an attacker gaining initial access and their detection. Reducing dwell time is a primary goal of threat hunting. The 2023 Mandiant M-Trends report found a global median dwell time of 16 days, down from over 200 days a decade earlier, partly attributable to improved hunting and detection.
Related terms
- Blast Radius
- The full set of systems, accounts, and data that an attacker has accessed or could access given their current level of compromise....
- Breach Notification
- The legal obligation to inform regulators and affected individuals when personal data is compromised in a security incident. Timelines and thresholds differ...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Continuous Authentication
- An authentication approach that verifies user identity throughout an active session rather than only at login, using passively collected behavioural signals to...
- Corroboration
- The practice of confirming an observed attacker action by finding evidence of the same action in at least two independent data sources,...
- Covariate Problem
- In forensic gait analysis and computer-vision gait recognition, the degradation in accuracy caused by variations in viewpoint, clothing, footwear, walking speed, surface,...
- Declaration Threshold
- The criteria defined in an organisation's IR plan that a suspected event must meet before it is formally declared a confirmed incident,...
- ENFSI ENGAGE
- The European Network of Forensic Science Institutes' Gait Analysis across Europe project (2013-2015), which produced the principal best-practice manual for forensic gait...
- Equal Error Rate (EER)
- The point on a classifier's detection error tradeoff curve where the false accept rate equals the false reject rate. Lower EER indicates...
- Flight Time
- The interval between the key-up event of one key and the key-down event of the next key in a keystroke sequence. Also...
- Forensic Gait Analysis
- The comparison of an unknown person's gait as captured on CCTV or other footage against reference gait footage of a known individual,...
- Forensic Readiness
- The organisational state in which people, processes, and technology are prepared to collect and preserve digital evidence with minimum disruption to business...
Explained in these topics
- Behavioural Biometrics: Keystroke, Gait and Mouse DynamicsIn keystroke dynamics, the duration in milliseconds for which a key is held depressed between the key-down and key-up events. A component of an individual's ty...
- Incident Response Goals and PrinciplesThe interval between an attacker's initial compromise of a network and the moment the organisation detects the intrusion. Shorter dwell time directly limits th...
- Proactive Threat Hunting MethodologyThe period between an attacker gaining initial access and their detection. Reducing dwell time is a primary goal of threat hunting. The 2023 Mandiant M-Trends...
- Scoping and Confirming an IncidentThe elapsed time between an attacker's initial access and detection. Dwell time is calculated from the incident timeline and is a key metric in post-incident r...