Reducing Dwell Time, Key To Protecting Critical Corporate Assets

In the world of cybersecurity, dwell time is a key concept with which it is essential for companies to become familiar, and refers to the period during which an attacker remains undetected within a corporate network. During this time, attackers can observe and analyze system behavior, identify vulnerabilities and plan more damaging or devastating attacks. Therefore, reducing this time is of vital importance to minimize potential damage and protect an organization's critical assets.

One of the biggest risks is the time attackers have to move laterally within the network and compromise critical assets before being detected. Prolonged dwell time can hinder detection and response, and increase remediation costs, exposing companies to greater legal and reputational risks.

A recent Mandiant report, M-Trends 2024, revealed that the global average dwell time in 2023 was 10 days, which is a significant improvement over 2022. However, the reality is that, in many cases, attackers need only a few hours to compromise critical assets, such as an Active Directory (AD). Sophos X-Ops found that, on average, attackers can reach an AD in as little as 16 hours. This underscores the importance of having robust security measures in place that quickly detect an intrusion and enable an immediate response.

Mandiant notes that in the Americas, 51% of organizations first learned of a security breach through an external source, usually from the attackers themselves in the form of a ransom note, while 49% identified breaches internally, and the average dwell time was also 10 days.

It is important to specify that the dwell time varies depending on the type of attack and the industry affected. For example, ransomware attacks typically have a shorter dwell time of about five days, according to Sophos. Although reducing this time is a priority, measuring it accurately remains a challenge due to the complexity of tracking the origin and spread of the threat within a network.

A case with one of the most extensive documented dwell times was that of the Marriott International hotel chain, which in September 2018 was alerted to access to its reservation database. During the investigation it was discovered that the attackers had access to the data of about 500 million customers for about four years, since 2014, without being detected. It is estimated that among the compromised data there would be around 327 million records that would include sensitive information about payment methods used.

In this context, artificial intelligence is positioned as a powerful tool to strengthen cyber defenses. During 2024, organizations have adopted AI-supported technologies to improve cyber threat response, as these tools can accelerate the analysis of large volumes of data while improving the contextualization of this information and transforming it into actionable threat intelligence.

In addition, AI is helping to close the cybersecurity talent gap by automating complex tasks that traditionally required significant human intervention. This use of technology allows organizations to more proficiently handle the growing number of threats without the need to proportionately augment their cybersecurity team.

However, it is critical to remember that AI alone is not a panacea. Prevention remains the first line of defense and organizations must take a comprehensive approach to cybersecurity. As Forcepoint points out, there are five essential practices that enterprises should implement to reduce dwell time and improve both threat detection and containment.

First, implement fundamental security controls, such as device hardening. Second, maintain granular visibility and correlated intelligence on the network, which involves using tools such as Netflow to monitor traffic and detect anomalies. Third, continuous monitoring of end devices is key to putting the pieces of an incident together and correlating events that, on the surface, may not be related. Fourth, predicting human behavior through attack profiling allows organizations to anticipate an attacker's movements. Finally, user education and awareness are vital; employees must be well informed about security policies and emerging threats.

AI can also carry risks and be a double-edged sword. While it helps identify vulnerabilities, it can generate security flaws that lead to information leaks. Data used to train AI could be compromised, exposing sensitive information and generating serious damage to companies. In addition, an increase in the sophistication of AI-driven cyberattacks, such as deepfakes and adaptive malware, which evade detection more effectively, is anticipated

From the above we can state that dwell time remains a critical indicator of the effectiveness of a cybersecurity strategy. Although statistics show a downward trend, cybercriminals continue to develop new techniques to evade detection. Therefore, organizations must maintain a proactive approach, combining the adoption of advanced technologies such as AI with prevention strategies and continuous training for their employees.

An attacker's ability to operate unrestricted for an extended period exponentially increases the damage they can cause, making dwell time reduction a priority in any cybersecurity strategy. This reduction is not just about detecting and responding to threats faster, but creating an environment where prevention and advanced detection work together to protect organizations in the cybersecurity landscape, the evolution of which into the future will depend largely on how companies use new tools to keep their defenses one step ahead of cybercriminals.