Long dwell time is the extended period between intrusion and detection. It gives attackers room to harvest credentials, move laterally, stage exfiltration, or prepare ransomware, which usually turns a single breach into a broader operational and data-loss event.
Expanded Definition
Long dwell time is the interval between an initial intrusion and its discovery. In security operations, the term usually describes the time an adversary remains inside a trusted environment before defenders detect the compromise, not the duration of an exploit itself.
The boundary matters. Long dwell time is often confused with persistence, but they are not identical: persistence is how an attacker keeps access, while dwell time is how long that access goes unnoticed. It is also distinct from incident response time, which begins after detection. In practice, long dwell time is a detection and visibility problem that reflects monitoring coverage, alert fidelity, and investigative speed.
Definitions vary across vendors and reports, but the operational meaning is consistent: the longer a compromise remains hidden, the more time the attacker has to expand access, collect secrets, and alter systems. For a broader identity-oriented reference on how hidden compromise intersects with machine identities and secrets, see the Ultimate Guide to NHIs.
Examples and Use Cases
Long dwell time shows up in several common security situations:
- A phishing compromise remains undetected while the attacker searches mailboxes, cloud consoles, or source repositories for reusable credentials.
- A service account is abused quietly, allowing lateral movement across workloads before any alert links the activity to the original entry point.
- Ransomware operators spend days or weeks staging backups disruption, privilege escalation, and data theft before they detonate encryption.
- API keys or tokens leaked into code, build logs, or configuration files are harvested long before teams notice the exposure.
- Insider misuse can also create long dwell time when legitimate access is used in ways that do not trigger immediate suspicion.
The tradeoff is usually between sensitivity and noise. Better detection may shorten dwell time, but overly broad alerting can bury analysts in false positives and delay the response that would actually interrupt the intrusion.
Security Implications
Long dwell time is dangerous because it converts a single foothold into a full compromise opportunity. Once inside, an attacker can enumerate identities, collect secrets, move laterally, and identify high-value data or recovery paths before defenders notice.
The main failure mechanism is delayed detection. If logging is incomplete, identity activity is not correlated, or secret usage is not monitored, attackers can operate under normal-looking access patterns. That delay increases blast radius, especially in environments where credentials are reused, privileges are broad, or service accounts are poorly inventoried.
NHIMG research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which makes dwell time especially costly when machine credentials are involved. A common practitioner observation is that the most serious damage is often caused not by the initial intrusion, but by the quiet period that follows it.
Domain and Governance Relevance
In NHI governance, long dwell time is not just a SOC metric. It directly affects how quickly compromised service accounts, API keys, tokens, and certificates can be identified, contained, and revoked. The longer an NHI compromise remains invisible, the more likely it is that the attacker can harvest additional secrets or use the identity as a stepping stone into other systems.
This makes dwell time a lifecycle issue as much as a detection issue. Inventory gaps, weak ownership, poor secret rotation, and missing offboarding processes all lengthen the window during which machine identities can be abused without detection. In environments with autonomous agents or automated pipelines, the governance impact is even sharper because one hidden compromise can affect many downstream actions at machine speed.
For that reason, long dwell time is a useful lens for judging whether identity visibility, logging, and revocation processes are actually keeping pace with modern NHI exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0008 — Lateral Movement | Long dwell time gives attackers time to move from the first foothold into more systems. |
| TA0006 — Credential Access | Extended undetected access enables harvesting of passwords, tokens, and API keys. | |
| TA0003 — Persistence | Attackers use hidden time on host or in cloud to maintain access before discovery. | |
| Recommendation — Correlate delayed detection with lateral movement indicators and contain the spread early. Prioritise credential-access telemetry and investigate hidden secret harvesting activity. Hunt for persistence mechanisms that explain how access survived unnoticed. | ||
| CIS Controls v8 | 8 — Audit Log Management | Shortening dwell time depends on logs that surface abnormal access and identity use. |
| 6 — Access Control Management | Long dwell time becomes more damaging when accounts and privileges stay active too long. | |
| Recommendation — Centralise and review logs so suspicious activity is detected before it compounds. Remove unnecessary access paths quickly to reduce the attacker's window of use. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Secrets Management | Hidden compromise often persists through exposed or unrotated machine secrets. |
| Recommendation — Rotate and protect machine secrets so stolen credentials stop extending dwell time. | ||
Related resources from NHI Mgmt Group
- Why do edge appliances with long dwell time and opaque internals create higher breach risk for enterprise security teams?
- How do organisations reduce the dwell time of exposed credentials at scale?
- How should security teams reduce attacker dwell time in identity environments?
- Why does dwell time matter so much for service accounts and privileged identities?
