Leadership wants lower dwell on the county network and proposes buying more wall screens for the SOC. What actually moves dwell?
Select an answer to reveal the explanation.
Short Explanation
Dwell is not a TV problem. It shrinks when you notice faster and kick the adversary out faster—MTTD plus MTTR—with detections and Asset and Identity that tell you the host matters. Extra wall screens without that are expensive wallpaper.
Full Explanation
Dwell is driven by how long activity goes undetected plus how long response takes after detection, so MTTD and MTTR together move it. Better correlation searches and Asset and Identity priority help analysts detect and act on the right civic assets. Additional displays without detection or enrichment improvements do not change adversary presence. Disabling A&I removes criticality context that should tighten response on high-impact systems.