Longer dwell time gives adversaries more opportunity to escalate privileges, move laterally, stage data, and establish persistence. It is usually estimated from forensic evidence of earliest confirmed activity versus detection timestamps, and reported as an average or median across incidents.
Key points
Detection-health signalShrinking dwell time reflects better telemetry, hunting, and coverage — not simply more tooling.
Distribution over averageA few undetected long-tail intrusions distort means; median and range tell a truer story.
Important limitationDwell time can only be measured for incidents that are eventually found. Undiscovered compromises have unknown, possibly infinite, dwell times — so reported figures always understate the worst case.