Detection Lag (Dwell Time)

What detection lag actually measures

Detection lag has two endpoints: the moment a change becomes observable on a competitor's public surface, and the moment a person on your side knows about it. Everything between those two points is lag, and it accumulates in stages. A change must first be published, then captured on the next crawl of that page, then flagged as significant enough to surface, then routed to someone and read. A slow polling interval, a change that slips past a diffing threshold, or an alert that lands in an unwatched channel each adds to the total.

Because it spans multiple stages, detection lag is a whole-pipeline metric, not a property of any single component. A fast crawler paired with a noisy alert stream that nobody reads can produce worse real-world lag than a slower crawler with tight routing. The honest way to measure it is end to end: pick known past changes, find when each went live, find when your team first registered it, and take the difference. Reported as a median across many changes rather than a single best case, it describes how current your competitive picture typically is.

Where the "dwell time" label comes from

The parenthetical is a direct loan from cybersecurity. There, dwell time is the duration an intruder operates inside a network before detection, and it has been tracked for well over a decade, most visibly in Mandiant's M-Trends reports. The security industry has driven that number down sharply over the years, from a median measured in hundreds of days to low double digits, which is why the metric is a familiar shorthand for how blind an organization is to activity it should be watching.

The analogy is useful but imperfect. In security, dwell time measures exposure to an active threat, and the stakes are breach containment. In competitive intelligence, the "intruder" is a competitor whose moves are public by design, and the cost of lag is a missed response window rather than a compromise. Borrowing the word imports its intuition, not its formal definition. It is worth keeping the two straight when a search for "dwell time" surfaces security material that does not map cleanly onto competitor tracking.

Detection lag vs. polling interval and response time

Detection lag is easy to conflate with the settings and metrics around it. Polling interval, or crawl frequency, is an input: how often a monitor checks a page. A 15-minute interval caps how fresh detection can be, but it does not guarantee low lag, because significance scoring, routing, and human reading still sit downstream. Detection lag is the outcome that interval partly determines, measured after the fact against real changes.

On the other side, detection lag stops the moment your team is aware. What happens next is a separate clock. Competitive response time measures how long it takes to act once you know, and some practitioners use "signal-to-action latency" for that detection-to-response stretch. Keeping them apart matters operationally: a team can have excellent detection lag and still lose deals because its response time is slow, or vice versa. Improving the wrong half wastes effort. Detection lag is also distinct from Mean Time to Detect, the security KPI it resembles, which is calculated as an average across many incidents rather than the observed duration of specific ones.

How CI teams manage detection lag

Detection lag is not something to minimize uniformly. It is a budget to allocate against how fast a given surface can hurt you. Pricing pages for a close competitor in a price-sensitive market may warrant real-time or near-real-time checks, because a price cut that goes unnoticed for a week can quietly bleed conversions. Careers pages, content hubs, and slower-moving marketing copy often tolerate daily checks, since the cost of learning a day late is low. Setting one aggressive cadence across every page usually just manufactures noise.

Reducing lag where it matters means attacking the whole chain, not only crawl frequency. Tightening what counts as a significant change keeps trivial edits from burying real moves, and clean routing puts the alert in front of the right person instead of a shared inbox nobody reads. This is where detection lag connects to the wider monitoring stack: change detection determines what is caught, significance scoring determines what surfaces, and alert routing determines how fast it reaches a human. A monitoring program that tracks competitor websites, pricing, and hiring continuously can hold lag low on the surfaces that justify the attention and let it drift on the ones that do not.

Frequently Asked Questions

Related terms