Attacker Dwell Time: The Dental Security Metric You Ignore

A faint intruder moving quietly through a dental office network while a large clock shows many months passing

October 18, 2026 Ten Months Inside: The O2 Dental Breach and the Security Metric Your Practice Is Ignoring

Posted at 05:37h in IT Security by Raymond

In early October, the Interlock ransomware group added O2 Dental Group — a US dental services organization operating under the O2 Smiles brand — to its public leak site, claiming it had taken patient health records, dental imaging, and insurance billing data. We covered that disclosure, alongside a second practice and a six-figure HIPAA penalty, in our look at two dental breaches landing in a single week. The breach itself was grimly familiar. One detail in the subsequent analysis was not.

According to incident researchers, the attackers may have first gained access to O2’s network back in December 2025 — the better part of a year before the ransomware actually fired. That timeline is an estimate, not a confirmed fact, but it describes something that is now the norm rather than the exception: a long, quiet occupation of the network, spent on reconnaissance and lateral movement, before a single file was encrypted. There is a name for the time an intruder spends inside a network before they are discovered. It is called dwell time, and it is the one security metric most dental practices never think to measure.

The breach you see is the end of the story, not the start

It is tempting to picture a ransomware attack as a single moment — a bad click on Monday, encrypted files by Tuesday. Modern intrusions rarely work that way. The visible event, the encryption and the leak-site listing, is the final act. Everything that matters happens before it, out of sight.

A typical intrusion unfolds in stages: initial access (often a phished credential or an unpatched edge device), then a patient period of reconnaissance — mapping the network, finding the server that holds the patient records, learning where the backups live and how they are protected. Then lateral movement, quietly stepping from the first compromised machine to more valuable ones, and persistence, planting ways back in so a single cleaned computer does not evict them. Only when they have mapped everything and located your backups do they detonate. By then they have had, in cases like O2’s, months to prepare the maximum-damage version of the attack.

A timeline where most of a ransomware attack is a long quiet stretch before a short loud encryption event at the end — Encryption is the last act, not the first. Most of an attack is the quiet reconnaissance that precedes it.

Why dwell time is the metric that matters

Most of a dental practice’s security spending — and nearly all of its attention — goes to prevention: the firewall, the spam filter, the password policy. Prevention is essential, but it answers only one question: how do we keep attackers out? Dwell time answers a second, more uncomfortable one: when they get in anyway, how long will it take us to notice?

For a practice relying on a consumer antivirus and a hope that nothing gets through, the honest answer is often “not until the files are encrypted.” That is a dwell time measured in months, and it is the difference between the two possible endings to this story. Catch an intruder during reconnaissance, and you have a contained incident and a cleanup. Catch them at the moment of encryption, and you have O2’s: stolen records, a public leak site, regulatory exposure, and weeks of downtime. The attack is the same; only the detection speed changed the outcome.

Shrinking the gap: detection, not just defence

Reducing dwell time means investing in the half of security that watches the inside of the network, not just the wall around it. For a dental practice, that comes down to a few practical capabilities:

Endpoint detection and response (EDR). Unlike traditional antivirus, which checks files against a list of known-bad signatures, EDR watches behaviour on each workstation and server — an account suddenly probing other machines, a process trying to disable backups, credentials being harvested — and flags it as it happens. This is the single most effective tool for catching the quiet middle of an attack.
Managed detection and response (MDR). Alerts only help if someone is watching them. Few practices have a security analyst on staff, which is why many pair EDR with a managed service that monitors around the clock and responds to alerts at 2 a.m. so the practice does not have to.
Meaningful logging and review. A business-grade firewall and your servers can record what is happening at the perimeter and inside — but logs nobody reads catch nothing. Centralised, reviewed logs turn scattered records into early warning.

A network defended by both an outer firewall wall and internal monitoring sensors that spot a suspicious node — Prevention guards the perimeter; detection watches the inside. A long dwell time is a failure of the second, not the first.

Limiting how far a quiet intruder can travel

Detection shortens dwell time; good architecture limits what that time is worth to an attacker. The reconnaissance and lateral-movement phases are only dangerous because, on a flat network, every machine can reach every other one. Network segmentation — keeping imaging devices, clinical workstations, office IoT, and guest Wi-Fi on separate isolated zones — means an attacker who lands on the front-desk PC cannot simply stroll to the imaging server. It is one of the concrete benefits of moving to business-grade network security, and it turns a whole-practice compromise into a contained one.

It also matters where the intrusion starts. The majority of these long-dwell attacks begin with a phished credential or a staff member’s click, which is why awareness training is not a soft, optional extra — it is the control that denies attackers the quiet head start in the first place.

An endpoint sentinel on a workstation detecting unusual activity and alerting a central monitoring console — Endpoint and managed detection shrink dwell time by watching behaviour continuously, not just blocking known-bad files.

What this means for your practice

The lesson of the O2 breach is not “ransomware exists” — every dental practice knows that by now. It is that the clock starts long before the alarm goes off, and that a practice which only measures whether it has been breached, rather than how fast it would know, is flying blind through the most dangerous part of the attack. Prevention keeps the odds in your favour; detection decides how bad it gets when the odds lose.

And because no detection is perfect, the backstop still matters most. When an attacker has had months to find and target your backups, the only recovery you truly control is one they could not reach — which is exactly why an immutable, air-gapped backup is the last line that turns a catastrophe back into an inconvenience. Prevention, detection, segmentation, and recoverable backups are not competing choices; they are the four things that, together, make a practice defensible.

A dental network with a firewall, segmented zones, internal monitoring sensors, and an offline backup vault — A defensible practice layers prevention, segmentation, detection, and recoverable backups — so a quiet intruder has nowhere far to go.

How Compudent Systems can help

At Compudent Systems, we help dental practices across the GTA and Ontario close the detection gap — deploying endpoint detection and response, pairing it with monitoring so alerts are actually acted on, segmenting imaging and clinical systems to limit how far any intrusion can spread, and maintaining the logging and immutable backups your HIPAA and PHIPA obligations expect. Contact Compudent Systems for a security assessment, and let us make sure that if someone gets into your network, you find out in minutes — not in months.

Sources & further reading:

Ten Months Inside: The O2 Dental Breach and the Security Metric Your Practice Is Ignoring