In incident-response reporting, attacker dwell time generally means the period between an intruder's initial compromise and discovery. It is a useful indicator of how long the attacker may have had to explore systems, steal data or establish persistence.
Security teams estimate dwell time from logs, endpoint telemetry, authentication records and reconstructed timelines. If the earliest confirmed malicious activity occurred on Monday and defenders detected the intrusion on Friday, the observed dwell time spans roughly four days.
The figure is often uncertain: the first visible event may occur after the actual intrusion, logs may have expired and an investigation can uncover older activity later. Different industry reports use different populations or definitions, making average dwell-time figures hard to compare.
To reduce dwell time, collect useful telemetry, correlate unusual behavior across systems, investigate high-confidence alerts promptly and exercise incident-response procedures. Measure both time to detect and time to contain, since recognizing an intrusion does not immediately remove the attacker.