The recent F5 hack, as reported by Wired Magazine, revealed a chilling reality: a sophisticated nation-state hacking group lurked undetected in F5’s systems for years, compromising BIG-IP appliances used by Fortune 500 companies and US government agencies. This prolonged infiltration—enabled by stolen source code, unpatched vulnerabilities, and customer configurations—created an “imminent threat,” as flagged by CISA. The key enabler?
Dwell time—the period hackers remain hidden in a network, quietly escalating privileges and planning attacks. At YouAttest, we specialize in identity governance and offer a powerful solution to combat dwell time through user access reviews (UAR) and advanced features like identity triggers and AI-powered trust scores. Here’s how we address this critical identity-driven threat.
Image 01: YouAttest addresses the key issue in “Dwell Time”, rogue and overprivileged accounts in the identity infrastructure.
What is Dwell Time?
Dwell time is the duration between a hacker’s initial network breach and their detection or removal. In the F5 incident, this stretched over years, allowing attackers to control the build system and access sensitive data. Industry data, like IBM’s Cost of a Data Breach Report, estimates average dwell times at 56 days, but advanced persistent threats (APTs) like F5’s can persist far longer. During this period, hackers perform reconnaissance, escalate privileges, move laterally, and exfiltrate data, all while evading detection. It’s like an intruder living in your house, learning its weaknesses, and striking when ready.
Why Is Dwell Time So Dangerous?
Extended dwell time amplifies a breach’s impact. Hackers use this time to install backdoors, exploit vulnerabilities, and cover tracks via anti-forensics, as seen in the F5 hack where proprietary code and configurations were stolen. The consequences are severe:
- Financial Impact: Breaches with long dwell times cost an average of $4.45 million, per IBM, with costs rising as detection delays grow.
- Operational Disruption: Compromised systems, like F5’s BIG-IP appliances, can lead to ransomware, denial-of-service attacks, or supply-chain exploits.
- Regulatory Fallout: Failure to secure sensitive data (e.g., PHI, PII, CUI) risks violations of SOX, HIPAA, or GDPR, incurring fines and reputational damage.
The F5 hack underscores how dwell time enables hackers to weaponize stolen identities, turning a foothold into a full-scale attack across the Cyber Kill Chain.
Dwell Time: An Identity Problem
Dwell time thrives on identity vulnerabilities. Over 50% of breaches involve compromised credentials, per Verizon’s DBIR. Hackers target orphan accounts (from former employees), ghost accounts (in unmanaged systems), or over-privileged accounts ripe for escalation. In the F5 breach, stolen configurations likely included credentials that extended dwell time. Privilege escalation—where hackers elevate low-level accounts to admin status—enables lateral movement and persistence, as seen in attacks like Colonial Pipeline. Without robust identity governance, these vulnerabilities create a playground for attackers, prolonging dwell time and amplifying risks.
How User Access Reviews Can Help
User access reviews (UARs) are a proven defense against dwell time. By systematically auditing who has access to what, UARs ensure compliance with the Principle of Least Privilege (NIST CSF 2.0 PR.AA-05). Managers review user permissions, flagging anomalies like privilege creep or dormant accounts. In incident response (IR), UAR aids investigation by identifying suspicious admin mappings and supports remediation by removing orphan accounts. For change management, UARs comparespre- and post-change states to catch unintended privileges. In financial systems, it prevents fraud by securing sensitive access. Regular UARs disrupts the Cyber Kill Chain, shrinking dwell time by eliminating identity vulnerabilities.
How YouAttest Combats Dwell Time
YouAttest, a cloud-based identity governance platform, deploys in minutes via SSO integration with Okta, Microsoft Entra ID, Salesforce, and more. Our advanced features directly target dwell time, enhancing security and compliance (e.g., SOX, SOC 2, ISO 27001). Here’s how:
- Automated Access Reviews: YouAttest automates UARs with pre-built campaigns for users, groups, and applications. Auto-scheduling (daily, weekly, quarterly) and auto-delegation to managers streamline certification, revocation, or re-delegation. This catches ghost accounts and privilege creep early, reducing dwell time by ensuring continuous attestation. For example, post-F5 breach, automated reviews could verify BIG-IP admin privileges across affected networks.
- Identity Triggers on Key Accounts/Groups: Our real-time identity triggers alert managers to changes in privileged groups, like admin additions or removals. As outlined in our PAM blog, triggers force attestation for changes, catching malicious escalations instantly. This is critical for IR remediation, as seen in F5, where early detection of privilege changes could have limited dwell time.
- ML-Based Identity Trust Score: Our AI-powered Identity Trust Score, detailed in our Zero Trust blog, assesses user risk based on permissions and behavior. It flags over-privileged or low-confidence accounts that hackers exploit for persistence. Integrated with state-in-time auditing, it compares privilege snapshots to detect anomalies, aligning with CISA’s Zero Trust Maturity Model for real-time governance.
These features, deployable in minutes, empower organizations to secure identities, comply with regulations, and disrupt hacker dwell time.
Summary: Stop Dwell Time with YouAttest
The F5 hack is a wake-up call: dwell time turns minor breaches into catastrophic threats through identity exploitation. User access reviews, powered by YouAttest’s automation, triggers, and AI-driven trust scores, are your shield against this silent danger. Don’t let hackers linger in your systems. Contact YouAttest for a demo and secure your identities today—before the next F5-level breach strikes.
- AI Agents Are Privileged Identities. Their Access Needs to Be Reviewed. - October 3, 2026
- AI Is the Unrealized Insider Threat: Why Enterprise AI Security Starts With Existing User Access - September 20, 2026
- The Service Account Wasn’t the Initial Breach. It Became Part of the Attack. - September 13, 2026
