In 2011, the median intrusion in one large incident-response firm's caseload had gone unnoticed for 416 days before anybody found it. In the same firm's 2025 cases, it was 14.
That fall is real in the sample that produced it, and you, as a managed service provider (MSP), will see it quoted a good deal this month as proof that defenders are winning. Some of them are. Before you repeat the number to a customer, look at who did the noticing.
Who raised the alarm
The 2025 data splits the victims by how they found out. Just over half, 52%, found the intrusion themselves. A third, 34%, were told by an outside organisation. The remaining 14%, about one in seven, were told by the attacker, usually in a ransom note.
Each group went unnoticed for a different length of time. When the victim found the intrusion, the median was nine days. When an outsider told them, it was 25. When the attacker told them, it was seven.
Ransomware ends its own dwell time. Its business model depends on the victim finding out, so it pulls the median down by announcing itself. Intruders who want to stay hidden behave differently: in the same caseload, espionage and North Korean operatives hired as remote IT workers went unnoticed for a median of 122 days. And the headline figure rose last year, from 11 days to 14.
Four years inside a hotel chain
On 29 July 2014 an attacker installed a web shell, a small program that gives remote control of a server, on the network of Starwood Hotels. In 2016 Marriott bought Starwood, and the network came with it. On 7 September 2018 a database query set off an alert, and the next day the intrusion was raised with Marriott.
The Information Commissioner's Office (ICO) fined Marriott £18.4m. Its penalty notice says the decision relates solely to failures after 25 May 2018, when the current data protection rules took effect, so the fine covers roughly the last fifteen weeks of an intrusion that ran for just over four years.
It surfaced because a query tripped an alarm. A much older crime ends the same way: occupational frauds run a median of 12 months before they are caught, and the commonest way they come to light is a tip-off.
The figure nobody has for UK small businesses
None of these numbers was measured in UK small businesses. The government's Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses, and 46% of small ones, identified a breach or attack in the past year. It counts only the breaches firms "were able to identify and willing to report", and it does not ask how long any of them went unseen. A quarter of businesses have a formal incident response plan.
The global medians cannot fill that gap. They come from organisations large enough to hire an incident-response firm, or already paying one to watch. One such firm saw its median halve in a year, and its own press release put that "largely" down to adding its monitored customers to the data. Every figure in circulation counts only the intrusions somebody found.
So nobody can tell your customer their number, and that includes us. We looked for a published UK small-business figure and there is none. Whether the ICO or the cyber insurers hold the dates that would produce one, we have not established.
A week of history
Picture a customer's office at ten past six on an ordinary weekday. The IT lead is the last one in, closing a ticket before going home, and nothing is wrong that anybody can see. In the cupboard by the kitchen, the firewall is recording every connection in and out of the building, and on the factory setting it shipped with, it will keep a week of them.
The office scenario above is invented. The setting is one incident responders keep finding: in one firm's 2025 cases, logs that should have been there often were not, largely because firewalls kept only seven days by default, and in some cases 24 hours. The same cases put 88% of ransomware deployments outside business hours.
If an intruder got into that office in the spring, the record of when was overwritten a week later. Nobody will ever know how long it lasted, the customer included.
Making the number knowable
Neither of the following produces a dwell-time figure. They decide whether one could ever exist.
What is each customer's firewall keeping, and for how long? If it is still on the factory setting, a week is all there will be to reconstruct from. One incident-response firm advises keeping administrative logs for at least a year.
If something alerts at one in the morning, whose phone rings, and are they allowed to isolate the machine before they reach the client? An alert that waits for office hours has been seen, and nothing more.
Who would notice
When a customer asks how long an attacker could sit in their network unnoticed, the useful answer is a question back: who would notice? If the answer is the attacker, the median in the incident-response data is seven days, and it ends with a ransom note. That is where detection stops and response begins.
CMS vendors in this area
- eSentire: managed detection and response: a team that watches for, investigates and contains threats at any hour.
- ESET: endpoint detection and response, with a managed service option.
CMS Distribution distributes the vendors listed here. They appear alphabetically, and none paid for placement or reviewed this article.
Dwell-time figures, the 2011 baseline, the detection split and the log-retention advice are from Mandiant's M-Trends 2026, covering its 2025 incident-response cases. The out-of-hours share and the firewall defaults are from Sophos's 2026 Active Adversary Report (661 cases, global), and the halved median from Sophos's April 2025 press release. Both firms sell incident response and managed detection, their samples are their own cases, and neither appears in the panel above. UK figures are from the Department for Science, Innovation and Technology's Cyber Security Breaches Survey 2025/26 (self-reported). The Starwood dates and the scope of the fine are from the ICO's penalty notice of 30 October 2020, and the fraud figures from the Association of Certified Fraud Examiners' Occupational Fraud 2026. The office is an illustration. The photograph is generated rather than taken. No real person appears in it.
