When most people picture a cyberattack, they picture a moment — a breach, an alarm, a response. The reality is far worse. Attackers routinely spend months inside an organization’s network before anyone notices. IBM’s Cost of a Data Breach Report 2026 puts the average time to identify and contain a breach at 247 days, the first increase in five years. For higher education institutions, that number carries particular weight.
What dwell time actually means
Dwell time is the period between when an attacker first gains access and when they’re detected. During that window, they’re not sitting still. They’re mapping the network, escalating privileges, locating high-value data — student records, financial aid files, research data, faculty credentials — and establishing persistence so they can return even after you think they’re gone.
The longer the dwell time, the more damage: more data exfiltrated, more systems compromised, more lateral movement that turns a single phishing click into a campus-wide incident.
Why higher ed has a dwell time problem
Universities are built for openness — open networks, open access, open collaboration. That’s a feature academically and a liability operationally. The same characteristics that make a campus functional make it difficult to secure:
- Large, distributed networks spanning residence halls, research labs, administrative offices, and remote faculty
- Thousands of endpoints that are personally owned and largely unmanaged
- High turnover in the user population — students cycling in and out each semester
- IT teams stretched across helpdesk, infrastructure, and compliance simultaneously
- Budget pressures that consistently push security investment to next year’s list
The result: when an attacker gets in, they have time. Time most institutions don’t know they’re giving away.
What 247 days makes possible
Consider what a patient attacker can accomplish in that window:
- Map every system, user account, and file share on the network
- Identify and exfiltrate student PII, FAFSA data, and financial records covered under FERPA and GLBA
- Steal research data — some of which may be grant-funded or federally classified
- Plant ransomware payloads across dozens of systems, set to trigger simultaneously
- Create backdoor accounts that survive even a complete wipe and rebuild
By the time the breach surfaces, the damage is already done. The incident response cost is far higher than it would have been with early detection, and the legal and reputational exposure is compounded by months of unauthorized access.
How architecture changes the math
The answer isn’t more tools — most institutions already have more security products than they have staff to manage them. The answer is architecture.
A Zero Trust security model eliminates the implicit trust that makes long dwell times possible. When every user, device, and connection must verify before accessing resources, lateral movement becomes dramatically harder. Behavioral detection flags anomalies within hours, not months.
Building that architecture requires senior expertise — people who’ve done it in regulated environments, who understand the specific constraints of higher education, and who aren’t handing the work off to junior staff.
Related reading: 5 Cybersecurity Gaps Every Higher Ed IT Team Should Close and The ROI Case for Cybersecurity Investment in Higher Ed.
Need a practical roadmap? Talk with IT Core about your security architecture.
References: IBM Security — Cost of a Data Breach Report 2026; Mandiant (Google Cloud) — M-Trends 2024: Cyber Security Threat Intelligence.
Illustration: Icons8.