What does the dwell time metric indicate in cybersecurity?

• A. The attacker remained undetected in the environment for a longer period.
• B. Faster incident containment.
• C. The system uptime increases.
• D. Increased patch cadence.

Answer: (A)

Dwell time is the period during which an attacker is present in a network before being detected and acted upon. It measures how long malicious activity goes unnoticed, revealing how effective your visibility and monitoring are. A longer dwell time means the attacker stayed undetected for a longer period, which is exactly what this metric aims to quantify. The statement about the attacker remaining undetected in the environment for a longer period directly describes this concept.

The other ideas describe outcomes of security actions rather than the duration of an attacker’s presence: faster incident containment points to shorter dwell time, not longer; system uptime is about availability, not intruder presence; and increased patch cadence concerns how quickly vulnerabilities are patched, not how long an attacker remains inside.