Dwell time
Japanese 潜伏期間（ドウェルタイム）
How long attackers stay inside before anyone finds them. In the intrusions Mandiant investigated in 2025, the median was 14 days (M-Trends 2026).
Dwell time is how long it takes from the day attackers quietly get in to the day someone notices. It is like measuring how long an intruder stayed in an empty house before the owner realized. The longer it lasts, the more time attackers have to take information out or leave a back door for coming back later. That is why security people treat noticing quickly as being as important as keeping attackers out.
Watch out A median of 14 days in Mandiant's investigations means it is not unusual for nobody to notice for a good while after a break-in. The figure comes from investigations of attacks on organizations, so it does not map directly onto a small website, but it does mean someone may already have been inside before you applied a security update. After updating, check your logs too, and look for files or admin accounts you do not recognize.
Source: Google Cloud (Mandiant) M-Trends 2026