# What is dwell time in cybersecurity?

Dwell time is how long an attacker stays inside a network before being discovered. Mandiant's M-Trends 2026 report puts the global median at 14 days, for incidents it investigated in 2025, and many intrusions last far longer. The longer the dwell time, the more the attacker can learn, steal and prepare, which is why ransomware groups often spend days mapping a network before encrypting it. Dwell time drops when someone watches the inside of the network, not only the edge. Detecting the early steps, such as internal scanning, regular check-ins to an outside server or unusual connections between machines, is what shortens it.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-is-dwell-time

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What are MTTD and MTTR?](https://netsenx.com/en/faq/what-are-mttd-and-mttr)
- [What is shadow IT?](https://netsenx.com/en/faq/what-is-shadow-it)
- [What is a data breach?](https://netsenx.com/en/faq/what-is-a-data-breach)
- [What is a firewall?](https://netsenx.com/en/faq/what-is-a-firewall)
- [What is a router?](https://netsenx.com/en/faq/what-is-a-router)