A SOC manager reviews the quarterly metrics report and notices that although the mean time to respond (MTTR) has steadily decreased, one attacker maintained access to a compromised server for 47 days before any alert was raised. The manager wants to select the single metric that best quantifies this specific problem and drive improvement toward closing the gap. Which metric most directly measures the length of time an adversary remained undetected inside the environment?