MDR in 2026: where alert handling still falls short

At a glance

What this is: This is Prophet Security's 2026 MDR evaluation, which finds that alert handling, custom detection treatment, and response authority separate providers more than branding does.

Why it matters: It matters because MDR buyers need to test whether their provider investigates alerts at the depth their SOC expects, especially when custom detections and rapid containment are part of the operating model.

Context

Managed detection and response is a service model built around outsourced alert investigation, escalation, and sometimes containment. The governance gap is that buyers often compare MDR offerings on coverage claims while the operational differences sit in the handling of individual alerts, the depth of analysis, and who is allowed to act.

That matters for identity and access security because many high-value detections involve authentication chains, endpoint context, session revocation, and credential reset decisions. If the provider cannot see enough context or cannot act decisively, the control boundary shifts back to the customer during the exact moment when response speed matters most.

Key questions

Q: What breaks when MDR services never fully investigate alerts?

A: When alerts are filtered, auto-closed, or only partially reviewed, the organisation loses timely visibility into real identity and access risks. The main failure is not just missed noise, but missed escalation, missing evidence, and incomplete accountability. That creates a blind spot where compromised accounts or privileged actions can continue long enough to matter.

Q: Why do shared-analyst MDR models struggle with custom detections?

A: Custom detections require the provider to understand customer-specific logic, data sources, and environment context, which is harder to do at scale when analysts share many accounts. The result is often a split between vendor content that gets full treatment and customer-authored rules that get routed back to the SOC. That gap becomes more visible as the detection program matures.

Q: How should security teams judge whether MDR response authority is sufficient?

A: They should check whether the provider can act on confirmed threats without waiting for customer approval in the situations that matter most, such as host isolation, session revocation, and credential reset. If every containment step still requires a manual relay, the service is providing advice, not operational response. That may be acceptable, but only if it is deliberate.

Q: Should organisations choose MDR before AI SOC automation?

A: For many teams of one to six engineers, yes. MDR can provide 24/7 coverage, tuning labour, and operational consistency without forcing a small internal team to maintain automation logic continuously. If the organisation lacks mature detection engineering and clean telemetry, MDR is often the faster path to measurable security outcomes.

Technical breakdown

What counts as an investigation in MDR

In MDR, “investigation” can mean anything from automated enrichment and filtering to a human analyst reconstructing the event path across SIEM, endpoint, and identity telemetry. The practical difference is whether the provider is returning a verdict or simply routing a case. Mature programs should treat that distinction as part of the control design, not as an implementation detail hidden behind service language. The more a provider relies on shared analyst capacity, the more investigation depth becomes a constrained resource. That is why two MDR contracts can look similar on paper while producing very different operational outcomes once alerts start flowing.

Practical implication: define investigation depth in operational terms before renewal and test it with real alert samples.

Why medium-priority alerts expose the model's limits

Critical alerts usually get attention and low-value alerts often get closed fast, which leaves medium-priority alerts as the true test of the service. Those alerts are where early intrusion indicators, identity misuse, and weak signal combinations tend to sit, and they are also where analyst queues, capacity limits, and customer-specific context matter most. If the provider cannot spend enough time on that band of volume, the service may still look effective while the most consequential ambiguity goes unresolved. This is less a tooling problem than an economics problem built into the shared-human model.

Practical implication: review how the provider handles medium-priority alerts, not just confirmed incidents and obvious noise.

Custom detections and containment authority are separate controls

Custom detections test whether an MDR can support your own detection engineering work, while containment authority tests whether the provider can act when an alert becomes an incident. Those are distinct capabilities. A provider may investigate vendor-supplied rules well, yet treat customer-authored detections as out of scope. Another may escalate cleanly but still require approval before isolating hosts or revoking sessions. For identity-heavy incidents, that difference can determine whether the session is cut off in time or remains valid long enough for lateral movement to continue.

Practical implication: validate support for custom detections and response authority as two separate contract and workflow decisions.

NHI Mgmt Group analysis

The real MDR divide is no longer coverage, it is investigative depth. Buyers have moved past the question of whether outsourced monitoring is useful. The material question is whether a provider can preserve evidence quality, context depth, and escalation discipline at scale. When a shared analyst pool becomes the bottleneck, the service starts optimizing for throughput rather than security judgment, and that changes the control outcome.

Alert handling is an identity and access governance problem as much as a SOC problem. The alerts that matter most often involve authentication chains, session state, privileged access, or credential abuse. If the provider cannot walk that chain cleanly, the escalation becomes a handoff instead of a decision. Practitioners should treat provider visibility into identity telemetry as part of the operating model, not a bonus feature.

Custom detection coverage is the clearest signal of whether the MDR aligns with a mature security program. Once a team begins writing meaningful detection content, it has already outgrown a large part of the generic MDR promise. A provider that cannot investigate customer-authored detections at the same standard as its own content creates a split brain between owned detection logic and outsourced response. That split is where renewal dissatisfaction usually starts.

Response authority, not just investigation quality, is now a category boundary. Some teams need the provider to isolate, revoke, and contain without a human relay at 3 AM. Others need strict approval gates. The right answer depends on risk appetite and operating maturity, but the decision must be explicit because it defines who owns the blast-radius reduction when an incident is live.

Shared-human MDR is reaching its structural ceiling in mature environments. That does not make the model obsolete. It does mean the market is bifurcating between service-led triage and platform-led investigation. For practitioners, the renewal question is whether the current delivery model still matches the organization’s detection maturity, identity telemetry, and escalation expectations.

What this signals

Investigation depth is becoming the renewal issue. The market is no longer debating whether MDR works, but whether a shared analyst pool can still deliver the level of evidence and context mature teams now expect. That changes procurement from a coverage discussion into a control-quality discussion.

The alert-handling gap is most visible in the middle of the queue. Critical incidents usually get attention and noise gets discarded, but medium-priority alerts are where many identity-driven compromises first look ambiguous. Teams should pressure-test that band because it is where response quality most often diverges.

Custom detections expose whether the service supports the way your SOC actually operates. If the provider treats your own rules as second-class content, the MDR relationship will lag behind the maturity of the detection program. That is the point at which many organisations begin planning a platform-led alternative.

For practitioners

• Test medium-severity alert handling Run representative medium-priority alerts through the provider and measure whether they receive full investigation, enrichment only, or a shallow handoff.
• Validate custom detection support Submit alerts generated by your own correlation logic and confirm whether they are investigated with the same rigor as vendor-supplied detections.
• Separate escalation from containment rights Document who can isolate hosts, revoke sessions, and reset credentials, then confirm those actions match your incident authority model.
• Measure investigation transparency Require the provider to show the query path, evidence trail, and reasoning used for each escalation so your team can verify decisions without re-running the case.
• Track analyst continuity Review how many analysts handled your environment over the last renewal period and whether context loss is affecting escalation quality.

Key takeaways

• MDR in 2026 is defined less by vendor branding than by what happens to alerts after they fire.
• Medium-priority alerts, custom detections, and containment rights are the decision points that most clearly separate offerings.
• Mature teams should test investigation depth and response authority before renewal rather than assuming the contract already covers them.

Key terms

• Managed Detection And Response: MDR is a service model focused on detecting suspicious activity, investigating alerts, and helping contain attacks across threat-facing technologies. It is designed to turn telemetry into action, which makes it closer to security operations than simple platform administration.
• Investigation depth: The extent to which a SOC service moves beyond enrichment and triage to determine what happened, why it happened, and what evidence supports the conclusion. In practice, this determines whether the customer receives a ticket or a defensible case file.
• Containment Authority: The level of permission a provider or internal team has to take direct response action during an incident. It includes actions such as isolating a host, revoking a session, or resetting credentials, and it is often the control that decides whether a threat is stopped quickly or only documented.
• Custom Detection: A custom detection is a rule written to identify a specific behaviour, pattern, or control violation that matters to one organisation. In browser security, it can target DOM activity, headers, or request flows so defenders can detect business-specific abuse instead of relying only on generic signatures.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners who need to connect identity controls to operational security decisions. It is designed for security and identity teams building a stronger programme across access, privilege, and lifecycle control.