Threat detection dashboards are masking security coverage gaps
Conifers found 47% of deployed detections need fixes and about one-third of known threats lack coverage.
Conifers assessed 14,652 customer-written and vendor-managed detections across SIEM, endpoint, cloud, identity, email, and network tools. It found that 47% of detections in the average organization need attention because of logic bugs, missing telemetry, wrong data stores, duplication, or noise, even though dashboards still show them as deployed. Organizations had detections or hunts for 63% of threats flagged by their own intelligence and reliable coverage for 64% of relevant MITRE ATT&CK techniques. Most queued alerts come from vendor-controlled rules that teams cannot edit.
- Conifers reviewed 14,652 detections; 47% in a typical organization need attention.
- Failures include logic bugs, missing telemetry, bad queries, duplicates, and noise.
- Average coverage was 63% of known threats and 64% of relevant ATT&CK techniques.
- Most analyst alerts come from vendor detections that customers cannot edit.
- The report urges continuous testing and automated intelligence-to-detection workflows.
- Vendors
- Conifers
From the original article
3 min read at helpnetsecurity.com
A detection rule can show up as deployed on a coverage dashboard and still never fire when an attacker uses the technique it was built to catch. Conifers assessed 14,652 detections in its customer base, including rules written by customers and detections managed by vendors in SIEM, endpoint, cloud, identity, email and network tools. The research found that 47% of detections in the average organization need attention.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.