Dwell time
The time an attacker remains in a system before being detected, a central indicator of an insured's detection capability and of the risk that the triggering event precedes the policy period.
Dwell time measures the interval between a system's first compromise and its detection. It is computed after the fact, through forensic investigation, and response firms publish each year the median observed across their engagements. The indicator has fallen sharply in a decade, for a reason less flattering than it looks: ransomware announces itself by encrypting, which mechanically shortens the average, while espionage intrusions sometimes remain invisible for years. For insurance it matters in three ways. It reveals the insured's detection capability, endpoint tools and monitoring center, which conditions severity. It determines how much data is exfiltrated, which grows with time. And it raises a contractual question: is an intrusion that began before the retroactive date, discovered during the policy period, covered? Claims-made policies answer through their retroactive date, and underwriters review incident history to avoid insuring a compromise already under way.
According to the annual report of a large incident response firm, the median time an attacker remained undetected was 416 days in 2011 and 10 days in 2023, the decline owing largely to the growing share of ransomware, which reveals itself.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.