Endpoint Visibility Gaps That Enable Dwell Time

Endpoint visibility gaps give attackers the time to stay hidden. The rise in dwell time is not simply a story about smarter attackers or weaker defenses. It reflects a mismatch between where organizations monitor and where adversaries operate. Closing that mismatch means monitoring the infrastructure that endpoint agents cannot reach and keeping it covered as the environment changes.

Why dwell time is rising again despite years of defender investment

Organizations have spent more than ever on security tools, yet attackers are staying inside their environments longer before they are found. That looks like a failure of investment, but the overall trend conceals two different kinds of intrusion. Groups driven by money want to act fast and have an immediate impact. Espionage groups favor quiet access that lasts. A measure that combines both can hide how serious the second problem has become.

M-Trends 2026 reports that median dwell time reached 122 days when filtered to cyber espionage and North Korean IT worker incidents. Fast ransomware cases pull the headline median down, while operations with long dwell times push it up.

M-Trends 2026 Executive Edition says the rise comes from some adversaries who establish persistence in infrastructure that usually has no standard telemetry. That makes the reversal structural. Endpoint investment can improve protection where agents run without improving visibility elsewhere. Security tools must therefore work and cover the places attackers have chosen to occupy.

How attackers exploit the boundary between monitored endpoints and everything else

The boundary of endpoint detection and response, or EDR, does not match the boundary of the network. An agent needs a compatible operating system. VPNs, routers, and firewall appliances remain part of the environment even when their embedded or proprietary systems, often incompatible with agent installation, place them outside its endpoint monitoring.

The gap has three main categories, namely edge devices, hypervisors, and the identity/SaaS layer. Hypervisors control virtual machines through management layers that guest-level EDR cannot see. Identity infrastructure and SaaS allow access through credentials and tokens without touching a monitored endpoint. These are different systems with the same practical consequence, which is that endpoint coverage does not amount to full visibility.

Network monitoring does not erase that distinction. Flow data shows that traffic occurred, leaving unclear what a device was instructed to do or what was installed on it. That missing behavioral context matters when attackers use network infrastructure for reconnaissance, lateral movement, and data staging. M-Trends 2026 identifies UNC6201 and UNC5807 as deliberately targeting edge and core network devices that typically lack EDR telemetry. These gaps also compound one another, because access in one category can provide a route into the next.

Edge devices as the preferred entry point for long-dwell operations

Edge devices are not merely overlooked machines. They are useful staging grounds because they are trusted to pass traffic and often cannot support the tools concentrated on workstations and servers. Choosing such a device is a way to avoid monitored systems.

The group then used valid credentials, likely captured on those devices, to access VMware vCenter and ESXi hosts. BRICKSTORM cases produced some of the longest dwell times in the dataset. The malware operated where it generated no EDR alerts and left no artifacts on monitored hosts.

Patching alone cannot remove this exposure. M-Trends 2026 Executive Edition notes that some edge device exploits are weaponized before patches are available. Once credentials are captured, the next step may look like authorized administration. The edge device has then served two purposes, providing a quiet foothold and a trusted identity for access to core infrastructure.

How hypervisors extend a foothold into an entire virtual estate

A hypervisor foothold changes the scale of the intrusion. Endpoint agents inside virtual machines watch the guests, but the hypervisor controls those guests from a layer outside their view. Centralized management and shared storage make virtualization efficient. Those same features let an attacker act on an entire virtual estate without compromising each monitored machine separately. Guest-level protection is necessary, but it does not protect every layer the guest depends on.

M-Trends 2026 identifies ransomware groups using REDBIKE (Akira) and AGENDA (Qilin) as exploiting the “Tier-0” nature of hypervisors. Rather than confronting guest defenses, they target virtualization storage directly. Encrypting hypervisor datastores makes all associated virtual machines inoperable simultaneously. The agents inside those machines do not change who controls the storage beneath them.

M-Trends 2026 also documents a UNC6201 path involving suspected, unconfirmed edge device initial access, Dell RecoverPoint for Virtual Machines zero-day exploitation, and access to vCenter and ESXi. Operations took place outside guest-level visibility.

Identity can also extend the damage into recovery systems. M-Trends 2026 describes attackers exploiting misconfigured Active Directory Certificate Services templates to create persistent admin accounts that survive password rotation, then deleting backup objects from cloud storage. This makes identity more than a means of moving between devices. It is another control layer where attackers can preserve access, and another visibility gap in its own right.

Identity and SaaS as telemetry deserts where lateral movement looks like normal work

Identity-based access creates a different problem from malware on an appliance. The attacker can use a recognized credential to perform activity that looks legitimate at the endpoint level. No malicious process needs to appear on a workstation for that access to matter. The relevant evidence sits in the identity and SaaS environment instead.

M-Trends 2026 shows how adversaries gather long-lived OAuth tokens and session cookies to get past standard defenses. A valid token can allow access to SaaS resources as a recognized user without a new authentication event to trigger an alert. Attackers can also get hard-coded API keys and personal access tokens through third-party SaaS vendors that have been compromised. Those credentials let attackers into downstream customer environments through trusted connections, so lateral movement can take them from one organization into another.

M-Trends 2026 reports that voice phishing became the second most common initial infection vector in 2025, with attackers targeting IT help desks to bypass MFA and access SaaS environments. The weakness can lie in a device, in software, or in the process that grants access.

An attacker could begin on a VPN appliance, pivot to vCenter, and extract API tokens from a management interface to reach SaaS resources. That chain crosses network, virtual, and SaaS environments without necessarily producing endpoint telemetry at any stage. If the relevant systems leave the activity unlogged, that gap in the evidence persists.

Why log retention limits prevent organizations from seeing how far back the damage goes

Even when an intrusion is found, the evidence needed to explain it may already be gone. Retention policies built around normal operational needs do not necessarily cover the time a patient attacker spends inside. Detection can establish that access exists now without revealing when it began. That leaves the organization investigating only the surviving part of the intrusion.

M-Trends 2026 reports that BRICKSTORM intrusions averaged 393 days of dwell time, over a year. Under a standard 90-day log retention policy, logs from the start of such an operation will be gone by the time it is found. M-Trends 2026 singles out limited retention as a critical gap that keeps organizations from finding the initial access vector. Retaining logs for less than the attacker's dwell time removes evidence needed to understand how the attacker got in.

Without that record, the organization cannot establish which credential was first compromised, which systems were touched before the visible period, or whether other backdoors were created. Remediation becomes partly guesswork because the known intrusion may be only a fragment of the real one. Sparse logging on edge devices, hypervisors, and SaaS identity systems makes that reconstruction harder still.

For an espionage operation, outlasting retention is itself an advantage. Once the earliest evidence expires, defenders lose the trail back to entry, even if newer activity eventually exposes the operation.

How EDR coverage drift turns a deployment decision into an ongoing gap

Not every blind spot sits beyond EDR’s technical reach. Some appear on devices that should have working agents but do not. New systems arrive without automated enrollment, infrequently connected systems let agents expire, and exclusions accumulate without review. Each change can shrink actual coverage without triggering an alert. A completed deployment therefore describes protection at the time of deployment.

An attacker who finds an unenrolled device has found a gap that the organization may believe is covered. The security decision was made, but the enforcement did not hold. In practical terms, an absent or ineffective agent cannot provide the visibility expected from it.

Unlike an appliance that cannot support an agent, this gap is measurable through routine comparison. Comparing the device management enrolled list with the EDR enrolled list on a regular cadence reveals missing coverage and allows accountability for each unmonitored device. Without a dedicated security team, that comparison often has no owner and never happens. Coverage must therefore be treated as a continuous metric.

M-Trends 2026 documents a hand-off of 22 seconds from initial access to secondary group operation. At that speed, defenders have little time to find missing coverage after an attacker exploits an entry point. Architectural decisions address systems agents cannot reach, while process discipline keeps protection working on systems they can.

What closing these gaps actually requires for a lean team without dedicated security staff

For a founder, IT generalist, or operations leader, the practical starting point is knowing what exists and what produces usable telemetry. The three structural gaps need different monitoring approaches, but all depend on that inventory. Integrating device management with security tooling makes missing agents, missing network logs, and unmonitored SaaS connections visible. Without that link, coverage remains an assumption.

For edge devices, network logging should include syslog, NetFlow, and configuration change auditing. These sources cannot reproduce host telemetry, but they can establish a behavioral baseline against which unusual activity becomes detectable. Their retention also needs to reflect real-world dwell times. For hypervisors, monitoring belongs at the management plane, using hypervisor management events, vCenter access logs, and datastore activity. Those sources need explicit retention and alerting configuration.

Identity and SaaS require continuous monitoring of authentication events, token issuance, OAuth grants, and privileged access patterns. Because valid credentials make the activity look legitimate, detection depends on behavioral baselines. To support these controls as systems change, teams must enforce coverage so that the inventory matches what is being monitored.

An integrated platform brings device management, endpoint security, identity protection, and compliance enforcement together to address that coordination problem. For a lean team, its practical value is consistent enforcement without the overhead of managing separate tools and vendors. Integration helps the team see where an incompatible appliance needs a different control and keep that control in place.

The attacker’s advantage is speed, while the defender’s advantage is knowing the environment better than the attacker does. Visibility gaps surrender that knowledge. An integrated platform helps restore it by connecting inventory, monitoring, and enforcement. Consistent, enforced visibility is a decision about how the environment runs.