Attacker Dwell Time: How Long Do Intruders Go Undetected?

Short read

This post covers attacker dwell time: how long intruders stay inside a network before anyone notices. Mandiant's M-Trends 2026 puts the global median at 14 days, and we walk through the timelines of seven well-known breaches, from SolarWinds and Equifax to Change Healthcare and Colonial Pipeline.

You'll see why the warning signs were usually there long before discovery, and five practical habits for shortening dwell time, including investigating every alert and covering nights and weekends, which is what urgentic BLUE is built to do.

Attacker dwell time is the number of days an intruder spends inside your network before anyone notices. It decides how bad a breach becomes: not whether an attacker got in, but how long they had once they did. This article explains what dwell time is, how long attackers typically go undetected, and what the timelines of seven well-known breaches tell us about closing the gap.

What is attacker dwell time?

Mandiant, which publishes one of the most widely cited annual studies on the subject, defines dwell time as the number of days an attacker is present in a compromised environment before they are detected. The clock starts at the first evidence of malicious activity and stops at discovery.

Both points can be hard to pin down. Investigators often find earlier activity as they dig, and "discovery" can mean an internal alert, a call from the police or a ransom note. So the figures below say exactly what each one measures.

How long do attackers go undetected?

According to Mandiant's M-Trends 2026 report, the global median dwell time across its 2025 investigations was 14 days, up from 11 days in 2024. For cyber espionage incidents and North Korean IT worker cases, the median was 122 days, about four months.

Two other findings from the same report stand out:

• Organisations found the intrusion themselves 52% of the time in 2025, up from 43% in 2024. The rest of the time, someone else told them, often the attacker.
• The median time between an initial access group getting in and handing access to a second group, such as a ransomware crew, fell from more than eight hours in 2022 to 22 seconds in 2025.

Two weeks sounds short until you consider what an attacker can do with it. Ransomware groups do not need months.

Seven breaches, measured in days undetected

We looked at the published timelines of seven major breaches, using what the victims, regulators and investigators said afterwards.

• SolarWinds, 2019-2020. SolarWinds' own investigation puts the earliest suspicious activity on its internal systems in September 2019. Malicious code was being inserted into Orion builds from 20 February 2020, and the affected releases shipped between March and June 2020. SolarWinds was informed of the attack on 12 December 2020: more than 15 months after first access, and roughly nine months after the first tainted updates reached customers.
• Equifax, 2017. Attackers began their attack through the online dispute portal on 13 May 2017. The US House Oversight Committee's report found they remained undetected for 76 days, until staff renewed an expired security certificate on 29 July and immediately saw suspicious traffic. The monitoring device had been blind for 19 months. The GAO's review gives the same dates.
• Midnight Blizzard and Microsoft, 2023-2024. Microsoft says the attackers began a password spray against a legacy, non-production test tenant account in late November 2023. It detected the attack on 12 January 2024, around seven weeks later.
• Storm-0558, 2023. The US Cyber Safety Review Board records that the attackers gained access to email accounts on 15 May 2023. The US State Department spotted anomalies on 15 June and alerted Microsoft on 16 June: 32 days. The board also heard the intrusion may have started earlier than 15 May.
• Target, 2013. The US Senate Commerce Committee's analysis cites reporting that attackers first got into Target's network on 12 November 2013. Cards used in its stores were affected from 27 November, and Target says it was not aware of the breach until the US Department of Justice contacted it on 12 December. That is 15 days of card theft, and around a month from first access.
• Change Healthcare, 2024. UnitedHealth Group's chief executive told the US Senate that criminals used compromised credentials on a Citrix portal without multi-factor authentication on 12 February. Ransomware was deployed nine days later, on 21 February.
• Colonial Pipeline, 2021. Mandiant's testimony to the US House Homeland Security Committee puts the earliest evidence of compromise at 29 April 2021, a login through a legacy VPN profile. A ransom note was found on 7 May: eight days.

None of these organisations were urgentic clients, and we are not claiming urgentic would have caught any of them. The point is what their timelines have in common.

The signal was there

In almost every case, something detectable happened long before discovery:

• A dormant route came back to life. Colonial's attackers signed in through a VPN profile that was not meant to be in use. Midnight Blizzard got its foothold on a forgotten test account.
• Alerts fired and were not acted on. The Senate report says Target's malware detection system triggered urgent alerts as the data-theft malware was installed in late November and early December, and its antivirus flagged the same server around 28 November.
• Unusual traffic was visible to anyone who could see it. Equifax spotted suspicious traffic leaving its portal as soon as its monitoring was restored.
• Someone built the right rule and read the log. The State Department caught Storm-0558 because its security team had written a custom alert on mailbox access logs, and investigated it even though similar alerts had been false positives before.

The difference between a short dwell time and a long one is rarely whether a signal exists. It is whether anyone is watching, and whether they look at the alert properly when it arrives, at 2am as well as 2pm.

How to shorten dwell time

It comes down to a few habits:

1. Collect the logs that matter, and keep them. Identity, VPN, cloud, email and endpoint logs are where early signs show up. Mandiant recommends retaining logs well beyond the common 90-day window, because some intrusions run for far longer.
2. Watch for the quiet signs, not just malware. Dormant accounts signing in, password spray, new OAuth apps and unexpected outbound traffic are all detectable.
3. Investigate every alert, not just the loud ones. Treating low-severity alerts as noise is how attackers get weeks. We wrote about this in what an alert actually costs you before anyone looks at it and the cost of alert fatigue.
4. Cover nights, weekends and holidays. Attackers do not keep office hours, and an alert that waits until Monday is a weekend of free time for them.
5. Close the doors you have forgotten. Legacy VPN profiles, test tenants and password-only portals recur in these timelines, as we covered in our article on MFA gaps.

This is the problem urgentic is built for. urgentic BLUE collects logs and detects threats across cloud, servers and endpoints, and urgentic's specialist AI agents investigate every alert around the clock, with an evidence-backed report in under three minutes. They work across the tools you already run, including Microsoft Sentinel, as shown on our platform page. No tool can promise to stop every attack. But the timelines above show how much depends on the gap between the first signal and the first person, or agent, who looks at it.