A reported $292 million protocol exploit. No credential, no dwell time, no log — and no ability to disconnect while you investigate.
A five-day difference in median dwell, attributable to who noticed. It is the strongest available case for spending on detection.
This database is a sample of long dwell times. Fast detection is exceptional here and apparently ordinary elsewhere.
Five months quiet, ten days of theft. A single dwell-time figure conflates the two, and organisations optimise against the wrong phase.
Encryption is the moment the attacker chooses to be seen. It happens after the theft, because the theft is the leverage.
Not a dwell time. Nobody was inside, because nobody needed to be.
How a file opens, how it closes, and why we never grade on ransom size.