Dwell time measures how long an intruder goes unnoticed. Incident-response firms report it as a median across the breaches they investigate; Mandiant’s M-Trends 2026 put the global median at 14 days for 2025, with espionage cases far longer. It is the defender’s clock, and it runs from the first foothold to the first alert someone acts on.
It matters because most damage happens inside that window: reconnaissance, privilege escalation, data theft. AI agents shorten the attacker’s side of the race, working at several operations a second, while dwell time is still measured in days. The gap between the two is where an organisation loses.
Reducing dwell time is mostly about watching actions rather than artefacts: unusual tool calls, bulk data reads, credentials used in odd places. For AI agents specifically, that means logging what each agent does under its own identity, so a rogue one stands out within minutes instead of weeks.