# What is Dwell Time?

> Dwell time is how long an attacker remains inside an environment before detection — the interval between initial compromise and discovery.

- Canonical URL: https://yellowcube.eu/glossary/dwell-time/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Longer dwell time gives adversaries more opportunity to escalate privileges, move laterally, stage data, and establish persistence. It is usually estimated from forensic evidence of earliest confirmed activity versus detection timestamps, and reported as an average or median across incidents.

### Key points

- **Detection-health signal:** Shrinking dwell time reflects better telemetry, hunting, and coverage — not simply more tooling.
- **Distribution over average:** A few undetected long-tail intrusions distort means; median and range tell a truer story.
- **Important limitation:** Dwell time can only be measured for incidents that are eventually found. Undiscovered compromises have unknown, possibly infinite, dwell times — so reported figures always understate the worst case.

### Related terms

[Mean time to detect (MTTD)](<https://yellowcube.eu/glossary/mean-time-to-detect/>) · [Threat hunting](<https://yellowcube.eu/glossary/threat-hunting/>) · [Incident response (IR)](<https://yellowcube.eu/glossary/incident-response/>) · [Lateral movement](<https://yellowcube.eu/glossary/lateral-movement/>) · [Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>)

### Sources

[NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations](https://csrc.nist.gov/pubs/sp/800/61/r3/final) · [MITRE ATT&CK](https://attack.mitre.org/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.