Cybersecurity definition
What is Dwell Time?
By Cyber Tool Stack Editorial TeamUpdated
Definition
The length of time an attacker is present inside an environment before being detected — a key metric for measuring how well detection capabilities are actually working, since a longer dwell time generally means more damage done.
Where Dwell Time fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
MTTD / MTTRMean Time to Detect / Mean Time to RespondTwo core SOC performance metrics: MTTD measures how long it takes to notice something malicious happened, and MTTR measures how long it then takes to contain and resolve it, together showing whether a security program is getting faster over time.Threat HuntingThe practice of proactively searching historical activity data for signs of a compromise that never triggered an automatic alert.