thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Dwell Time

The length of time an attacker remains undetected in an environment from initial compromise to detection.

Definition

Dwell time reflects detection capability; industry reports such as Mandiant M-Trends showed global median dwell time falling to around 10 days in recent years, with ransomware often detected faster because it announces itself. Longer dwell time increases damage. Threat hunting aims to reduce it.

Example

An intrusion starting March 1 and detected March 21 has a 20-day dwell time.

Exam tip

Dwell time is the period of undetected presence; it overlaps with MTTD conceptually.

Related terms