Five months quiet, ten days of theft. A single dwell-time figure conflates the two, and organisations optimise against the wrong phase.