Dwell time is how long an intruder remains inside a network or building before being detected and removed. In cybersecurity it is measured from initial compromise to containment; in physical security it is the time between entry and response. Shorter detection time limits what an intruder can reach.
Detection is only half of the question. The other half is how long an intruder can work undisturbed, and that is what dwell time measures.
Dwell time in incident response
Dwell time starts when an attacker gains access and ends when they are removed, not when they are first noticed. Long dwell times mean more data taken, more accounts created and more persistence installed. Reducing it comes from detection, fast triage and authority to isolate a system quickly.
Physical and logical together
A badge left active after an employee departs is a physical version of the same problem: access that persists long after it should. Regular account and credential reviews, door event reporting and camera coverage of sensitive areas all shorten the window in which an intruder can operate.