Dwell time, not initial access, determines ransomware blast radius

At a glance

What this is: This analysis argues that ransomware outcomes are driven by dwell time, not initial access, because the longest undetected campaigns produce the largest blast radius.

Why it matters: IAM, PAM and security operations teams should treat detection speed and exposure reduction as the practical controls that shape ransomware impact, not just perimeter prevention.

By the numbers:

• The median dwell time for ransomware attacks tracked by Sophos in 2024 was 16 days.
• Mandiant's M-Trends 2024 report found a global median detection time of 10 days across all intrusion types.
• Recorded Future's 2024 Annual Report documented over 5,000 organizations publicly named by ransomware leak sites.
• Sprocket Security says 83% of attacks leverage misconfigured or exposed assets.

Context

Ransomware is best understood as a campaign with a delayed payoff, not a single moment of compromise. The critical governance problem is that many teams measure entry conditions while attackers exploit the interval between compromise and detection to move laterally, stage data and disable recovery options.

For identity and access programmes, that interval matters because valid credentials, standing privilege and backup access often become the attacker’s most valuable tools once initial access succeeds. Continuous visibility, not annual assurance, is what changes the operational outcome.

Key questions

Q: What breaks when ransomware dwell time is not measured?

A: Without a dwell-time measure, teams mistake initial access for the real risk and miss the period in which attackers harvest credentials, move laterally and disable recovery options. That creates a false sense of security because the incident is already operationally advanced before encryption starts.

Q: Why does longer dwell time increase ransomware damage?

A: Longer dwell time gives attackers more opportunity to discover privileged accounts, exfiltrate data and identify backup systems before they act. The longer they can observe the environment, the more precisely they can time encryption and maximise leverage.

Q: How do organisations know whether ransomware identity controls are actually working?

A: Look for reduced privilege breadth, shorter-lived elevated sessions, and faster revocation when suspicious activity appears. If a compromised identity can still reach backups, security tooling, or production management systems, the controls are not working. Effective programmes can demonstrate that access is constrained before attackers can convert it into business interruption.

Q: What should teams do when backup access sits inside the administrator model?

A: They should treat that as a blast-radius problem, because attackers who reach domain-level privilege can often reach backups next. Backup access should be scoped separately from broad administrative control so recovery is still available after account compromise.

Technical breakdown

Dwell time creates the attack window ransomware needs

Dwell time is the interval between initial compromise and detection. During that period, attackers use legitimate-looking access, built-in tools and stolen credentials to behave like normal users while they map the environment. The longer they stay hidden, the more time they have to identify backup systems, privileged accounts and high-value data. In practical terms, dwell time is not a side metric. It is the time budget that determines how far the intrusion can progress before defenders intervene.

Practical implication: measure detection latency as a core ransomware control, not just incident response speed.

Lateral movement and privilege escalation turn entry into blast radius

Once inside, ransomware operators usually focus on discovery, credential harvesting, privilege escalation and lateral movement. That sequence lets them reach domain administrators, backup infrastructure and systems that support broad deployment. The article’s core point is that the damage comes from what attackers accomplish after entry, not from entry itself. When valid credentials and over-permissioned accounts are available, the environment gives the attacker the means to convert a single foothold into enterprise-wide impact.

Practical implication: remove standing privilege and reduce backup-path access before attackers can convert one foothold into many.

Double-extortion makes backup reliance an incomplete recovery strategy

Modern ransomware increasingly combines data theft with encryption, which means restoration is no longer the only problem. If exfiltration happens during dwell time, attackers can threaten public release even when backups are available. That changes the security objective from simple recoverability to limiting what can be staged, copied and retained before detection. In identity terms, weak control over privileged access to data stores and backup systems expands both the theft window and the recovery problem.

Practical implication: treat data staging and backup compromise as separate controls, because restoring files does not erase stolen data.

Threat narrative

Attacker objective: The attacker’s objective is to maximise ransom leverage by stealing data, disabling recovery options and encrypting as many systems as possible after long undetected access.

1. Entry typically begins with phishing, an exposed VPN credential, an unpatched external service or access purchased from an initial access broker.
2. During dwell time, attackers perform reconnaissance, harvest credentials, escalate privileges and move laterally to locate backups and high-value systems.
3. They then exfiltrate data and prepare destructive payloads so encryption becomes the final step, not the first sign of compromise.

Breaches seen in the wild

• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius control is now the real ransomware governance problem. The article is right to shift attention away from entry narratives and toward the length of time an attacker can operate unseen. That shift matters because every extra day inside the environment expands reconnaissance, privilege abuse and data staging. For security leaders, the practical conclusion is that containment quality is determined before the ransom note appears.

Identity controls become attack-shaping controls once dwell time begins. Ransomware campaigns do not require exotic identity failures to succeed. They need valid credentials, excessive privilege and access paths that reach backups, domain administration and sensitive data. That is why IAM and PAM teams should treat privileged account scope and recovery-path access as ransomware blast-radius controls, not just access-management hygiene.

Annual validation creates an exposure calendar attackers can exploit. A once-a-year test assumes the attack surface is mostly static, but the article shows the opposite: the gap between assessments is where exposures accumulate and access brokers monetise them. Continuous testing and continuous exposure reduction are the only governance models that match the tempo of modern ransomware operations. The lesson is simple: if exposure is not current, blast radius is not bounded.

Attack surface visibility is the missing governance layer in many ransomware programmes. The article connects external exposure, compromised credentials and dwell time into one operational chain. That chain is the reason continuous perimeter validation now belongs alongside detection engineering and recovery planning. Organisations that cannot see exposed assets in near real time cannot claim meaningful control over ransomware spread.

From our research library:

• Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.

What this signals

Continuous exposure reduction is the governance response to dwell-time risk. Annual testing leaves too much time for new assets, open services and exposed credentials to accumulate between reviews. The operational question is no longer whether the organisation can pass a point-in-time test, but whether its exposure picture stays current enough to interrupt attacker preparation.

Ransomware resilience now depends on knowing which identities can reach recovery systems. If administrative accounts can reach backups, storage snapshots and identity infrastructure, the attacker’s post-entry options widen immediately. Programmes should treat backup-path privilege as part of ransomware resilience, not as a separate infrastructure detail. That is where identity governance and recovery design intersect most sharply.

For practitioners

• Measure detection time as a ransomware control Track the interval between initial compromise indicators and confirmed detection, then review it alongside lateral movement and exfiltration milestones.
• Inventory backup-path privilege Map which administrative identities can reach backup systems, recovery tooling and snapshot repositories, then remove unnecessary standing access.
• Continuously test exposed assets Move from annual perimeter reviews to continuous validation of internet-facing services, exposed credentials and newly introduced attack surface.
• Separate recovery from data-loss control Assume exfiltration may precede encryption and design controls that detect data staging, not just file encryption or service disruption.
• Rehearse board-level ransomware questions Have leadership answer how quickly compromise would be seen, how long remediation takes and whether backups are isolated from privileged account abuse.

Key takeaways

• Ransomware severity is shaped by how long attackers remain inside the environment before detection, not only by how they got in.
• Dwell time gives adversaries room to harvest credentials, escalate privilege, move laterally and stage data before encryption starts.
• Teams that want smaller blast radius need current exposure visibility, shorter detection windows and tighter control over backup-path privilege.

Key terms

• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Initial access broker: An initial access broker is an attacker or criminal intermediary that acquires footholds, such as stolen credentials, and then passes them to other threat actors. This role turns access into a commodity and increases the likelihood that simple credential exposure will become a broader breach.
• Multiple Extortion: Multiple extortion is an attack pattern that combines several pressure tactics, such as encryption, data theft, and threats to leak information. It increases leverage against victims because restoring systems alone does not end the incident, and organisations must address availability, confidentiality, and response coordination at the same time.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners strengthen identity controls that shape exposure, privilege and recovery outcomes.