// GLOSSARY

Dwell Time

The time between an attacker entering the environment and being noticed. It is considered the most honest measure of detection capability, because it tells not how many security products an organization has deployed but how long those products take to catch a real attack; the number of tools in the inventory is an investment indicator, dwell time an outcome indicator. The weight of this metric comes from this reality: in modern breaches the real harm accumulates not in the initial access but across the time the attacker spends unnoticed; the longer they stay invisible, the more lateral movement they make, the more identities they gather, and the closer they come to the critical target. But a lab assumption or a vendor brochure cannot show this duration; it is understood only by measuring it in a real scenario, in an engagement run without the defense's knowledge. The Modular Red Team Simulation and the assumed-breach scenario take this duration out of being an estimate and turn it into a measured fact; the detection-gap matrix then shows step by step why the duration stretched.