Dwell time
How long an attacker is inside your environment before they are detected.
Industry medians run from a couple of weeks to a couple of months, and in businesses without monitoring it is often measured from the ransom note backwards. Everything an attacker accomplishes happens inside this window.
Reducing it is the entire point of detection and response tooling. The difference between catching an intruder on day one and day forty is usually the difference between a contained incident and a full rebuild with a breach notification attached.
Where this comes up
Dwell time sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.