Why Dwell Time Matters to an MSP
Dwell time is the window an attacker has to explore a client's network, steal credentials, find backups and plan the damage. The longer it runs, the more they reach and the more the cleanup costs. For an MSP the window is wider than one client: your tools and admin accounts touch every client, so an attacker who stays unnoticed in your environment has time to reach all of them.
The breach-level version of this number, from identification through containment, is tracked as Mean Time to Identify and Contain a Breach. Dwell time is the first half of it: the time before anyone knew.
It is also a question clients ask after an incident, usually through their insurer or lawyer. How long were they in, and what did they see? An MSP that can answer with evidence is in a far stronger position than one that can only say the alert fired on Tuesday.
What Shortens It
Most security spending is really spending on a shorter dwell time. The controls that move it most for an MSP are detection and someone watching the alerts:
- EDR on every endpoint and server, with alerts that reach a person rather than a mailbox.
- MDR or a SOC for the hours your team is not working. See whether you need a SOC for the build or buy decision.
- Identity monitoring for impossible travel, new inbox rules and new admin accounts.
- Alerts on the things attackers touch before ransomware: backup deletion, disabled security tools, and new remote access software.
Tools alone do not shorten it. An alert that waits until Monday morning for triage adds the whole weekend to dwell time.
Write down who receives each alert type, how quickly someone must look at it, and who is on call when that person is away. For most MSPs the gap is not the tooling but the hours between an alert and a human reading it.
Measuring It Honestly
Dwell time is measured after the fact, during an investigation, by tracing back to the first sign of compromise. That only works if the evidence still exists.
| Evidence | Why it matters |
|---|---|
| Sign-in and audit logs | Show when an account was first misused |
| EDR telemetry | Shows the first process an attacker ran |
| Firewall and VPN logs | Show when outside access started |
| Email logs | Show the phishing message that began it |
If logs roll over before the breach is found, the start of the attack cannot be traced, and neither can the list of data that was exposed. Set log retention per client with that in mind, and check it against any compliance requirement such as HIPAA.
Common Questions
Is dwell time the same as MTTI?
They overlap. Mean time to identify is the average dwell time across incidents, measured from compromise to detection.
Should I report dwell time to clients?
Report it per incident in the post-incident summary. An average across a few incidents is too noisy to show at a QBR.
Does MFA reduce dwell time?
Not directly. MFA makes the first compromise harder; detection and response shorten the time after it happens.