The source also said the average length of time a bad actor is in a network before being detected is a year, so based on congressional inquiry and VA's testimony, these hackers already may have 10 years of combined access in their network through the nine separate incidents.