Dwell Time
Definition
The period between an attacker gaining initial access and their detection. Reducing dwell time is a primary goal of threat hunting. The 2023 Mandiant M-Trends report found a global median dwell time of 16 days, down from over 200 days a decade earlier, partly attributable to improved hunting and detection.
- Field
- Incident response and threat hunting
- Definition
- Time between initial access and detection
- 2023 Mandiant M-Trends global median
- 16 days
- Trend
- Down from over 200 days a decade earlier
Common questions
Why has median dwell time dropped so sharply over the past decade?+
Wider adoption of endpoint detection and response tooling, better log correlation through SIEMs, and organised threat hunting programs have all improved the odds of catching an intruder's activity earlier, though dwell time still varies widely by industry and attacker sophistication.
Does a short dwell time mean less damage was done?+
Not necessarily. A short dwell time reduces the window for lateral movement and data exfiltration, but a fast, targeted attacker such as one deploying ransomware can still cause severe damage within days, so dwell time is one risk indicator among several, not a direct measure of impact.
Related terms
- Blast Radius
- The full set of systems, accounts, and data that an attacker has accessed or could access given their current level of compromise....
- Breach Notification
- The legal obligation to inform regulators and affected individuals when personal data is compromised in a security incident. Timelines and thresholds differ...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Continuous Authentication
- An authentication approach that verifies user identity throughout an active session rather than only at login, using passively collected behavioural signals to...
- Corroboration
- The practice of confirming an observed attacker action by finding evidence of the same action in at least two independent data sources,...
- Covariate Problem
- In forensic gait analysis and computer-vision gait recognition, the degradation in accuracy caused by variations in viewpoint, clothing, footwear, walking speed, surface,...
- Declaration Threshold
- The criteria defined in an organisation's IR plan that a suspected event must meet before it is formally declared a confirmed incident,...
- ENFSI ENGAGE
- The European Network of Forensic Science Institutes' Gait Analysis across Europe project (2013-2015), which produced the principal best-practice manual for forensic gait...
- Equal Error Rate (EER)
- The point on a classifier's detection error tradeoff curve where the false accept rate equals the false reject rate. Lower EER indicates...
- Flight Time
- The interval between the key-up event of one key and the key-down event of the next key in a keystroke sequence. Also...
- Forensic Gait Analysis
- The comparison of an unknown person's gait as captured on CCTV or other footage against reference gait footage of a known individual,...
- Forensic Readiness
- The organisational state in which people, processes, and technology are prepared to collect and preserve digital evidence with minimum disruption to business...
Explained in these topics
- Behavioural Biometrics: Keystroke, Gait and Mouse DynamicsIn keystroke dynamics, the duration in milliseconds for which a key is held depressed between the key-down and key-up events. A component of an individual's ty...
- Incident Response Goals and PrinciplesThe interval between an attacker's initial compromise of a network and the moment the organisation detects the intrusion. Shorter dwell time directly limits th...
- Proactive Threat Hunting Methodology
- Scoping and Confirming an IncidentThe elapsed time between an attacker's initial access and detection. Dwell time is calculated from the incident timeline and is a key metric in post-incident r...