Dwelling time is the period an attacker remains inside a network before being detected or removed. It measures how long an intrusion can stay hidden while the attacker explores systems, steals data, or prepares later stages such as persistence and lateral movement.
It matters because longer dwell time usually means greater damage. An intruder with time can abuse valid accounts, harvest credentials, reach additional hosts, and quietly exfiltrate sensitive information. Defenders reduce dwell time with strong logging, alert tuning, identity monitoring, and rapid incident response. In practice, a long dwell time often points to weak visibility rather than a single missed alert, which is why historical logs, authentication records, and endpoint telemetry are critical for finding the full scope of a breach.