Why an Intruder May Wait Before Striking
A network intrusion does not always announce itself with an immediate outage or burst of damage. An attacker who gains access may instead move cautiously, using stolen credentials—login details such as passwords or session tokens—to enter additional systems while trying to look like a legitimate user. The time between an initial breach and its discovery or final impact is often called dwell time.
During that period, the attacker can map the organization’s digital environment: which accounts have broad permissions, where sensitive files are stored, and which systems depend on one another. This reconnaissance helps identify targets and routes through the network. It can also reveal whether security tools or staff are likely to notice unusual activity.
What the Delay Buys—and Costs
Waiting can make an attack more effective. If an intruder understands how systems are connected before disrupting them, the eventual theft or damage may be more focused. Stolen credentials can also provide continued access even if one infected device is cleaned up, especially when the underlying account or session remains usable.
But “dormant” does not necessarily mean nothing is happening. The malicious software may sit idle while an operator checks in intermittently, or the intruder may carry out quiet actions that blend into routine network traffic. The delay is part of the threat: by the time a visible incident begins, the attacker may already know where valuable information lies and how to reach it.
That is why defenders look for patterns such as unexpected account use and unusual movement between systems, not only obvious damage. A network can appear to be functioning normally while an intruder is quietly preparing the next step.
