Topic starter
19/08/2026 3:58 pm
TL;DR: Ransomware dwell time is the interval that determines how far attackers can move, what they can steal, and whether backups survive, according to Sprocket Security's analysis. Shorter detection windows materially reduce blast radius, because the encryption event is usually the last step in a campaign already underway for days or weeks.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Why Dwell Time is the Ransomware Variable That Matters Most”.
By the numbers:
- The median dwell time for ransomware attacks tracked by Sophos in 2024 was 16 days.
- Mandiant's M-Trends 2024 report found a global median detection time of 10 days across all intrusion types.
- Recorded Future's 2024 Annual Report documented over 5,000 organizations publicly named by ransomware leak sites.
Key questions
Q: What breaks when ransomware dwell time is not measured?
A: Without a dwell-time measure, teams mistake initial access for the real risk and miss the period in which attackers harvest credentials, move laterally and disable recovery options.
Q: Why does longer dwell time increase ransomware damage?
A: Longer dwell time gives attackers more opportunity to discover privileged accounts, exfiltrate data and identify backup systems before they act.
Q: How do organisations know whether ransomware identity controls are actually working?
A: Look for reduced privilege breadth, shorter-lived elevated sessions, and faster revocation when suspicious activity appears.
Practitioner guidance
- Measure detection time as a ransomware control Track the interval between initial compromise indicators and confirmed detection, then review it alongside lateral movement and exfiltration milestones.
- Inventory backup-path privilege Map which administrative identities can reach backup systems, recovery tooling and snapshot repositories, then remove unnecessary standing access.
- Continuously test exposed assets Move from annual perimeter reviews to continuous validation of internet-facing services, exposed credentials and newly introduced attack surface.
Bottom line: Ransomware severity is shaped by how long attackers remain inside the environment before detection, not only by how they got in.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:35 pm
Blast-radius control is now the real ransomware governance problem. The article is right to shift attention away from entry narratives and toward the length of time an attacker can operate unseen. That shift matters because every extra day inside the environment expands reconnaissance, privilege abuse and data staging. For security leaders, the practical conclusion is that containment quality is determined before the ransom note appears.
A few things that frame the scale:
- Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.
A question worth separating out:
Q: What should teams do when backup access sits inside the administrator model?
A: They should treat that as a blast-radius problem, because attackers who reach domain-level privilege can often reach backups next. Backup access should be scoped separately from broad administrative control so recovery is still available after account compromise.
👉 Read our full editorial: Dwell time, not initial access, determines ransomware blast radius