Dwell time
termsecurity
How long an intruder is inside before anyone notices - measured from first compromise to detection, and the single most honest number a security programme reports about itself.
Industry surveys have tracked it falling from many months to weeks over the past decade, driven by better endpoint telemetry and by the rise of ransomware, which announces itself and so shortens the average by being loud. That last point matters: a falling average can mean detection improved or that attackers stopped hiding. The related figure is breakout time, how long from first foothold to lateral movement, which is the window a defender actually has to act.
Also known as: time to detect, mttd, breakout time