What is dwell time in cybersecurity?

Dwell time is how long an attacker stays inside a network before being discovered. Mandiant's M-Trends 2026 report puts the global median at 14 days, for incidents it investigated in 2025, and many intrusions last far longer. The longer the dwell time, the more the attacker can learn, steal and prepare, which is why ransomware groups often spend days mapping a network before encrypting it. Dwell time drops when someone watches the inside of the network, not only the edge. Detecting the early steps, such as internal scanning, regular check-ins to an outside server or unusual connections between machines, is what shortens it.

← All 69 questions on What is…? Network and security termsAll topics