A SOC manager reviews last quarter's incident response metrics. The team's average time from the moment an attacker first compromised a host until an analyst opened an investigation was 14 days, while the average time from investigation start to full remediation was only 3 hours. To reduce overall attacker dwell time, which metric should the manager prioritize improving and what does it indicate?