Two Incident Response Practices Reported Dwell Times of 14 Days and Two Days

One major incident response practice reports a median dwell time of 14 days for 2025, falling to nine days where detection was internal. Another reports a median of two days across combined incident response and managed detection cases — seven days for incident response alone, four days for ransomware within that, and one to three days where managed detection was in place.

A managed detection service watches continuously and finds things in hours. An incident response practice is called after somebody notices, and the median it reports is partly a measure of how long noticing took.

Blending the two produces a low figure that describes neither. Separating them, as the second source does, is the more honest presentation and it is why its incident-response-only number is closer to the first source’s.

This database records dwell times of 102 days at Nevada, ten months in an unwatched ERP at 26-0620, five months at 25-0820. Against those, both medians look implausibly short.

They are not. The corpus records the incidents that became public, and an incident that ran for months is far more likely to become public than one caught in two days — the selection problem at 25-0807 and 25-1218b. This database is a sample of long dwell times.

Princeton ejecting an intruder within 24 hours at 25-1026 was described here as an outlier by two orders of magnitude. Against a two-day median it is unremarkable.

The corpus should stop treating fast detection as exceptional. It is exceptional in this database because this database is built from disclosures, and it is apparently ordinary among organisations with continuous monitoring.

Graded medium: two vendor populations, neither representative, and the comparison above is this desk’s reading of why they differ.