What is dwell time in cyber security?
Dwell time is how long an attacker is inside a network before anyone detects them. Mandiant’s M-Trends reports calculate it in days, counting from the attacker’s presence in the compromised environment until detection.
What it means in practice
The clock starts at the first unauthorized access, not on the day someone noticed. It stops at detection, and that can be the attacker’s own ransom note. The start date is usually only known after forensics has reconstructed the intrusion.
Mandiant’s median figures give a sense of scale. Its M-Trends 2024 report put the global median at 10 days for 2023, M-Trends 2025 reported 11 days for 2024, and M-Trends 2026 reported 14 days for 2025. The 2026 report puts the rise down to espionage and North Korean IT worker cases, which ran a median of 122 days.
A median is a headline, not a forecast. These numbers come from the investigations one firm was called in to work on, which isn’t a sample of every organization. The median also hides a long tail: M-Trends 2026 describes one threat with dwell times of nearly 400 days, and notes that standard 90-day log retention would leave an organization blind to how the attacker got in.
Mean time to detect is a related measure. Definitions of where its clock starts vary, so check before comparing numbers.
Where it shows up in an incident
Dwell time becomes a practical question once forensics begins. The dwell period is the window investigators have to examine, and your logs have to reach back far enough to cover it.
The same window shapes three decisions. For scoping, what could the attacker see, and for how long? For recovery, backups taken during the dwell period may already hold the attacker’s tools. For notification, regulators and affected people will want to know what data was reachable in that window. Ask your broker how the policy period and retroactive date apply when an intrusion began long before it was found.
Common mistakes:
- Treating the day of discovery, or the day of encryption, as the day the incident began.
- Short log retention that makes the early weeks unknowable.
- Wiping or rebuilding systems before forensics has preserved evidence.
- Resetting the one compromised account while the intruder holds others.
- Declaring the incident contained before the dwell period has been scoped.
The incident response checklist has an evidence-preservation step that is worth reading before you need it.
In a tabletop exercise
Inject, Day 2, from the forensic firm. “The earliest evidence of the attacker is a login to a VPN account seven weeks before the encryption. The attacker was moving through the network for much of that time.” Discussion: which backups pre-date the intrusion, and how would you know? What can’t you answer? Who needs to hear that the scope is wider than first reported: counsel, the insurer, the board?
Discussion question: “Our logs go back 30 days. What would we be unable to tell a regulator, and what would it cost to keep them longer?”
Sources
Want to see how your team would handle this for real? Here is how a facilitated tabletop works.