Dwell time is the hidden cost multiplier in identity breaches

At a glance

What this is: This article frames attacker dwell time as the identity-breach multiplier that determines how far intruders can move before detection and how costly the aftermath becomes.

Why it matters: It matters because identity, PAM and NHI teams influence how quickly stolen credentials are noticed, contained and revoked, which directly changes breach impact.

By the numbers:

• The 2013 Yahoo breach had about three years of dwell time before discovery.
• Mandiant reported that organizations detected intrusions within a median of 10 days in 2023.
• That was down from 16 days in 2022.
• Verizon lost $350 million on Yahoo's acquisition price after the breach became public.

👉 Read Unosecur's analysis of why dwell time multiplies identity breach cost

Context

Attacker dwell time is the period between first successful credential use and detection in an identity environment. The article argues that this window is the real multiplier behind breach cost because it gives intruders time to move, exfiltrate data and tamper with evidence before defenders see them.

The governance problem is not just visibility in the SOC. When credentials, admin utilities or non-human identities remain active and over-scoped, attack paths stay open long enough for a small foothold to become a larger incident with legal and reputational fallout.

Key questions

Q: What breaks when attacker dwell time is not measured in identity environments?

A: Teams lose the ability to see how long stolen credentials remain useful, so breach impact is underestimated until after lateral movement or exfiltration has already happened. Dwell time should be treated as an identity-risk metric because it links detection latency to business loss, not just to technical alerting speed.

Q: Why do overprivileged accounts make breaches harder to contain?

A: Because the compromise of one account becomes the compromise of whatever that account can already reach. Broad permissions shorten an attacker’s path to sensitive systems, increase lateral movement options, and make detection slower to matter. Least privilege reduces the blast radius by limiting what a stolen identity can do.

Q: How do security teams know if dwell-time controls are working?

A: Look for shorter detection windows, faster containment and fewer incidents where the attacker can edit logs, pivot laterally or exfiltrate data before response begins. If identity telemetry is continuous and response is automated, dwell time should shrink even when the first credential use still succeeds.

Q: When should organisations replace standing privilege with just-in-time access?

A: Organisations should replace standing privilege with just-in-time access whenever elevated access is not required continuously. JIT reduces the time window in which credentials can be abused, especially for admin tasks, break-glass use, and sensitive automation. It works best when paired with approval, expiry, and logging so temporary access does not become another form of standing privilege.

Technical breakdown

How dwell time grows after credential use

Dwell time begins after an attacker has valid access, not when the first malicious packet hits the perimeter. In the article's framing, stolen secrets, over-privileged service accounts and exposed API keys create quiet footholds that bypass classic perimeter alarms. Once inside, adversaries can blend into routine identity traffic, forge sessions and reuse legitimate utilities. The longer defenders rely on periodic review instead of live telemetry, the more time the attacker has to pivot, alter logs and expand reach before any alert fires.

Practical implication: Treat first credential use as the start of the incident clock, not detection time.

Why telemetry and response speed matter more than batch review

The article contrasts live telemetry with periodic log review because they create very different detection windows. Batch analysis means the breach is often discovered after the attacker has already completed lateral movement or data theft. Streaming identity and cloud events into real-time analytics shortens that window, while automated first-response steps can disable tokens or quarantine workloads before the attacker finishes the next move. This is why detection engineering and containment automation are part of identity risk management, not only SOC operations.

Practical implication: Replace delayed review cycles with real-time detection and machine-speed containment for identity events.

How privilege scope changes breach duration

Privilege level directly influences how long an attacker can stay useful once inside. A root key, domain-admin token or broadly scoped NHI credential gives immediate reach and reduces the noise that would otherwise expose suspicious activity. The article links least privilege, JIT elevation and segmentation to shorter dwell time because they limit what stolen access can do before it expires or triggers control boundaries. In practice, privilege design changes not just blast radius, but the attacker's available time to operate unseen.

Practical implication: Narrow standing privilege so stolen access expires or trips control boundaries quickly.

Threat narrative

Attacker objective: The objective is to remain undetected long enough to move laterally, steal data and maximise the eventual business and legal cost of the breach.

1. Entry occurs when an attacker gains valid access through a stolen or misused credential, which the article treats as the starting point for dwell time measurement.
2. Escalation follows when over-privileged access, admin utilities or weak monitoring let the attacker blend into routine identity traffic and expand reach.
3. Impact grows as the attacker exfiltrates data, edits logs and prolongs the breach long enough to increase legal, financial and reputational damage.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Dwell time is the breach amplifier that turns identity failure into enterprise loss: once a stolen credential is used successfully, every additional hour increases the chance of lateral movement, data loss and log tampering. The article is right to treat detection speed as a business variable, not just a SOC metric. For practitioners, the real question is how quickly identity misuse becomes observable and containable.

Periodic review is the wrong operating model for identity incidents: the Yahoo case shows that monthly or batch log review leaves attacker activity to hide inside normal traffic. That is a governance failure, not a tooling gap. Continuous telemetry and event-driven response are now the baseline expectation for any identity programme that handles high-value credentials or NHI access.

Least privilege is a dwell-time control, not only an access-control principle: over-scoped service accounts, admin utilities and reusable secrets give intruders more time to operate before they trigger resistance. This is where NHI governance, PAM and identity analytics converge. The practitioner implication is to reduce the time stolen access remains valuable, not just the number of permissions on paper.

Attacker dwell time exposes a hidden cost multiplier in identity architecture: legal exposure, acquisition discounts, customer churn and regulatory scrutiny all grow with time spent undetected. That makes identity control quality financially material, not just operationally neat. Teams should measure breach cost as a function of detection latency and privilege scope, then manage both together.

Identity blast radius: The article points to a simple concept with strong utility: the longer an attacker remains inside, the more of the identity estate they can touch before containment. This is the practical boundary between a contained incident and a business event with board-level consequences. Practitioners should map where dwell time is still being allowed to compound.

From our research library:

• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• 92% of cloud identities are over-permissioned and 62% are dormant.
• Read next: Privileged Access Management Guide

What this signals

Identity dwell time is now a governance metric, not only a detection metric: programmes that still depend on periodic review are leaving too much attacker value on the table. The control objective has shifted to reducing the time between first credential use and containment, which is where identity, PAM and detection engineering now intersect.

Least privilege shortens the attacker's usable window: when access is narrowly scoped, even a successful credential theft has less time and less reach to create damage. That makes privilege design a direct lever on breach economics, not a theoretical policy choice.

For practitioners

• Instrument identity telemetry continuously Centralize high-fidelity logs from IAM, cloud control planes and directory services so suspicious credential use is visible in near real time.
• Automate containment for identity events Use playbooks that disable tokens, quarantine workloads or block sessions as soon as suspicious access is confirmed.
• Reduce standing privilege on high-value identities Right-size admin roles, service accounts and API credentials so stolen access cannot persist with broad reach for long.
• Shorten session and key lifetimes Force re-authentication, shorten token TTLs and rotate credentials often enough that attackers must repeatedly regain access to keep operating.
• Run incident drills against dwell-time assumptions Test whether analysts can detect and contain identity misuse before it can spread beyond the initial account or workload.

Key takeaways

• Attacker dwell time is the period in which a stolen credential remains useful, and it is what lets a breach expand from an initial foothold into a larger business incident.
• The Yahoo case shows how long undetected access can magnify harm, while Mandiant's 10-day median demonstrates that even improved detection still leaves room for damage.
• Continuous telemetry, automated containment and narrower privilege scopes are the controls that most directly reduce the cost multiplier created by dwell time.

Key terms

• Attacker Dwell Time: Attacker dwell time is the period between initial compromise and detection or containment. In SaaS environments, long dwell time usually means access has blended into normal activity, often through legitimate identities or integrations. Reducing it depends on strong telemetry, behavioural detection, and fast incident response workflows.
• Identity Telemetry: Identity telemetry is the collection of signals generated by authentication, session, and access events across human and non-human identities. It becomes useful for governance when teams can baseline normal behavior and detect drift in source, privilege, or access frequency.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Containment Latency: Containment latency is the time between detecting suspicious activity and successfully limiting its spread. It is a practical resilience measure because the longer containment takes, the more chance an attacker has to move, exfiltrate data, or disrupt services.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The ten dwell-time levers the article walks through for logging, analytics, automation and privilege design
• The Yahoo case discussion that ties dwell time to valuation, litigation and reputational harm
• The article's plain-language explanation of how MITRE ATT&CK maps to post-compromise dwell time
• The business framing that connects shorter detection windows to lower legal and cleanup costs

👉 The full Unosecur post covers the Yahoo case, the ATT&CK framing and the ten dwell-time levers.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.