If you utilize the services of a MSSP, Managed Detection and Response (MDR) provider or Managed Security-as-a-Service provider today, this section should help you understand how your provider may or may not address Dwell Time and the value that provider delivers in helping to reduce risk to your organization.

We performed an anecdotal review of eight MSSPs, MDRs and Security-as-a-Service providers combined to look at:

1. Do they talk about Dwell Time, Mean-Time-to- Detection, Mean-Time-to-Response or other similar metric in content on their website or collateral?

2. Do they provide any actual metric for how they perform in terms of Dwell Time, Mean-Time-to-Detection, Mean-Time-to-Response or similar metrics?

Paying Lip Service to Dwell Time

7/8 security service providers mention the importance of reducing Dwell Time. However, 0/8 actually publish any
specific Dwell Time statistics.

The results were disappointing. Though seven of the eight vendors talked about Dwell Time and the importance of reducing it as much as possible, only one vendor talked about their operations being designed with Dwell Time in mind. However, not a single vendor actually published any specific Dwell Time statistics on their website or in marketing collateral.

Measuring Dwell Time is a crucial metric and operating tenet that providers must strive to deliver on beyond the apparent lip service being paid. Dwell Time also represents a clear way for organizations to prove the real value of their protection to customers beyond simple counts of events processed and alerts generated for the customer to then address.