Still Here

Everyone else is moving. He isn't.

Dwell time is the gap between when an attacker enters a network and when anyone notices. The industry average has hovered between two and three months for years. In some sectors — healthcare, critical infrastructure — it stretches past six. The attacker isn't sprinting. They're standing exactly where they are, hands folded, letting the environment move around them.

The reason dwell time stays high isn't technical. It's attentional. There's too much noise, too many alerts, too many people walking past. The threat that looks like it belongs doesn't get a second look. It gets ignored the same way you'd ignore someone standing on a sidewalk in New York City — which is to say, completely.

By the time someone looks up, the attacker has already mapped the environment. They know the schedules, the access patterns, the gaps in coverage. They've been there long enough to know what normal looks like — which means they know exactly how not to look abnormal.

Detection ends dwell time. Awareness ends detection failure. Neither happens by accident.

He'll still be there when you walk back.