Also known as: breach detection gap · time to detect
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
Dwell time is one of the more honest security metrics because it measures detection capability rather than prevention claims. Median figures have fallen substantially over the past decade, though this partly reflects the rise of ransomware, which announces itself, rather than universally better detection.
Long dwell times are most concerning in espionage-motivated intrusions, where the attacker's goal is persistent quiet access. Those cases are frequently discovered by external notification rather than internal detection.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Threat Hunting
Threat hunting is the proactive search for attackers already present in an environment, driven by hypotheses about adversary behaviour rather than by alerts from automated detection tools.
SIEM
A SIEM (Security Information and Event Management) system centralises log and event data from across an organisation's infrastructure, correlating it to detect suspicious activity and support investigation.
Lateral Movement
Lateral movement is the process by which an attacker who has compromised one system moves through a network to reach additional systems, typically hunting for higher-value data or credentials.
Initial Access Broker
An initial access broker (IAB) is a criminal specialist who breaches organisations and then sells that access to other attackers, such as ransomware affiliates, rather than monetising the intrusion themselves.