Rethinking MDR as Attackers and Defenders Embrace AI

Summary: The article argues that managed detection and response has not adapted to AI-enabled attackers, citing industry data that roughly 60% of alerts go unreviewed and that analysis of 25 million alerts in 2025 found nearly 1% of real threats originate in low-severity and informational alerts. It describes MDR investigation and detection engineering as operating in separate silos, with detection posture degrading faster than it improves and investigation logic hidden from customers.
Why it matters: In an enterprise generating 450,000 alerts a year, the article's math puts roughly 54 real incidents annually in the deprioritized queue where no one is looking, and research cited in the piece found more than half of confirmed compromised endpoints had already been marked 'mitigated' by the EDR vendor.

Read the original at The Hacker News ↗