Dwell Time
also called Mean Time to Detect
The period between an attacker gaining access and being detected — the metric that determines how much damage an intrusion can do.
Industry reporting has shown median dwell times falling from months to weeks over the past decade, which is progress and still long enough for an intruder to escalate privileges, enumerate systems, locate valuable data and stage exfiltration.
It matters architecturally because several design decisions directly determine it:
Log retention must exceed dwell time, or the evidence of initial access is already deleted when the investigation starts. Retention set at 30 days against a 60-day dwell time means the intrusion cannot be scoped.
Backup retention must exceed it too, or the only backups available are already compromised — which is precisely the ransomware scenario.
Detection coverage on the behaviours that occur during dwell: unusual data access patterns, IAM changes, new credentials, egress to unfamiliar destinations, and access at unusual times. Equifax's exfiltration went unobserved for months because an expired certificate had disabled the inspection that would have seen it.
The related metrics are mean time to respond and mean time to contain. Detection without a prepared response merely moves the delay.
The design question worth asking of any system holding valuable data: if an attacker had access for sixty days, what would tell us? For most systems the honest answer is nothing, which is where the work is.