Dwell time

Concept

In cybersecurity, dwell time is how long an attacker stays inside an environment before being detected; the episode presents it as a more meaningful SOC metric than MTTR.

Title graphic: Dwell time (Concept)

Type	Concept

Key points about Dwell time

One timeline cuts dwell time, false positives and audit pain. · Unify Hybrid Security with Microsoft Defender…
The result is shorter dwell time, fewer false positives and fewer midnight pages. · Conditional Access with Defender for Identity…
Tie metrics to outcomes such as response time and dwell time instead of vanity counts. · Build Better Phishing Reports with Defender…

Episodes about Dwell time

Unify Hybrid Security with Microsoft Defender XDR

2025-12-02 · Video on YouTube

Stop Buying Security Tools: The Shocking ROI of One XDR Timeline Drowning in alerts across M365, endpoints, and cloud apps? This video shows why your hybrid security stack is a Rube Goldberg machine that screams and still misses real attacks. You’ll see the…

Conditional Access with Defender for Identity Signals

2025-08-05 · Video on YouTube

Your best Microsoft 365 security signal isn’t the login—it’s what the identity does next. Wire Conditional Access (the gatekeeper) to listen to Defender for Identity (the watcher), and you’ll auto-raise friction when behavior turns risky—shrinking dwell time…

Build Better Phishing Reports with Defender and Power BI

2025-08-05 · Video on YouTube

Your phishing dashboard is lying to you. The “all good” charts hide near-miss clicks, silent investigations, and active campaigns threading your inboxes right now. We show how to tap Microsoft Defender’s buried signals and build living Power BI dashboards…

Timeline of episodes about Dwell time

Articles about Dwell time (1)

Executive KPIs That Actually Change Behavior: Moving Beyond Compliance
2026-08-11 · Mirko Peters
Welcome back, security leaders and data architects! As a podcaster who spends hours every week talking to CISOs, SOC leads, and enterprise architects, I hear the sa…

Frequently asked questions

How does XDR reduce alert fatigue?

By correlating email, identity, device and cloud signals into one incident rather than many separate alerts. The episode says this slashes false positives and dwell time and ends swivel-chair investigations. · From the episode: Unify Hybrid Security with Microsoft Defender…

What benefits does fusing the two bring?

Shorter dwell time, fewer false positives and less after-hours firefighting, because the identity's behavior after sign-in now influences access decisions. · From the episode: Conditional Access with Defender for Identity…

Which KPIs should phishing reports show?

Response time, dwell time and high-risk entities, plus who clicked, who reported and how fast you contained the threat. These tie phishing metrics to business outcomes rather than vanity counts of blocked mail. · From the episode: Build Better Phishing Reports with Defender…

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Feed for this topic (RSS): entity/dwell-time/feed.xml
M365.FM episodes on this topic: 3
Articles on this topic: 1

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-03