TL;DR: Roughly 40% of alerts are never investigated, while about 57% of organisations suppress or tune detections to cut noise, creating a gap between dashboard coverage and alert-level reality, according to Prophet Security. The real governance issue is not visibility alone, but whether investigation, timing, and evidence remain auditable under managed-service triage.
At a glance
What this is: This article argues that MDR dashboards can mask alert-level investigation gaps, especially when alerts are tuned out, partially handled, or closed without a full evidence chain.
Why it matters: It matters because IAM and security teams cannot rely on coverage metrics alone when investigation depth, timing, and auditable reasoning determine whether identity- and alert-driven threats are actually contained.
By the numbers:
- Prophet Security research puts roughly 40% of alerts as never investigated at all.
- A majority of organizations, around 57%, suppress or tune detection rules specifically to cut noise.
Context
Managed detection and response can create a false sense of control when dashboards show volume, escalation, and service health but hide what happened at the alert level. The core governance gap is between reported coverage and actual investigation quality, especially when triage decisions are shaped by provider staffing economics rather than the customer’s risk tolerance.
That gap matters directly to identity and access programmes because identity-related alerts, service-account anomalies, and suspicious authentication events are only useful if they are actually examined, not merely counted. In practice, the question is whether the provider can preserve investigation evidence, timing, and decision logic as auditable security controls rather than opaque service outputs.
Key questions
Q: What breaks when an MDR service claims coverage but not full investigation?
A: The control that breaks is assurance. A dashboard can show that alerts were received and closed, yet still hide suppressions, partial enrichment, and handbacks that never became real investigations. That leaves teams unable to prove that suspicious activity was examined to a standard they would accept internally.
Q: Why do suppressed detections create risk even when the MDR dashboard looks healthy?
A: Suppressed detections shift the security decision upstream, before a human analyst ever reviews the event. If the suppression criteria are driven by provider economics rather than your risk tolerance, you may never see the signals that mattered. The danger is not only missed alerts, but a hidden definition of what counts as relevant.
A: Security teams should judge MDR on both detection quality and analyst workload, not on alert volume alone. A service that finds attacks but floods teams with noisy notifications can create paralysis instead of protection. The better test is whether the provider filters false positives, investigates suspicious activity, and escalates only clear, actionable incidents with context that supports response.
Q: Should organisations keep MDR if they cannot export investigation context?
A: Only with caution. If the provider keeps the reasoning, queries, and institutional context inside its own workflow, the customer inherits dependency without portability. That creates switching friction and weakens auditability, so teams should treat context exportability as a contractual requirement, not a nice-to-have feature.
Technical breakdown
Why MDR dashboards and alert queues diverge
MDR dashboards usually aggregate operational outcomes such as alerts received, incidents escalated, and cases closed. That reporting layer can look healthy even when the underlying queue is heavily filtered by triage rules, severity thresholds, and analyst capacity. The real mechanism is simple: a provider can satisfy a service promise at the summary level while discarding or deprioritising large portions of the alert stream before a human ever reviews it. That creates a measurement problem, not just a staffing problem. The customer sees output metrics, but not the decision path that produced them.
Practical implication: Treat dashboard metrics as service telemetry, not proof of full investigation coverage.
How triage economics shape what gets investigated
Managed-service triage is constrained by human hours, so providers optimise for throughput. Low- and medium-severity alerts are often enriched, suppressed, auto-closed, or handed back with limited context because that is cheaper than full investigation. This is especially important for custom detections and noisy alert classes, which may be treated as second-class if they do not fit the provider’s standard playbooks. The result is a hidden policy layer: what gets investigated is often determined less by risk and more by what the provider can process at scale. That means the customer’s investigation posture is partly outsourced, whether explicitly intended or not.
Practical implication: Demand alert-level visibility into suppression, tuning, and handoff criteria.
Why evidence chains matter more than verdicts
A final ticket verdict tells you very little unless it is backed by the queries run, the evidence collected, and the reasoning used to reach the conclusion. Without that chain, a closed alert becomes an assertion rather than a defensible security decision. This is where managed detection often becomes brittle for identity-driven investigations: suspicious sign-ins, unusual service-account behaviour, and conditional-access anomalies require context that may never appear in the handback. If the provider’s analysts retain the working context, the customer cannot easily validate the decision or reuse the learning later. That undermines both trust and institutional memory.
Practical implication: Require providers to preserve the full evidence chain for every closed investigation.
NHI Mgmt Group analysis
Dashboard security is not investigation security. Managed-service reporting can prove that alerts were counted, escalated, or closed, but it cannot by itself prove that a meaningful investigation happened. That distinction matters because identity- and alert-driven threats are governed by evidence quality, not by volume metrics. Practitioners should treat summary dashboards as a starting point, not as assurance.
Alert triage creates a governance boundary, not just an operations layer. Once a provider decides which alerts are ignored, enriched, or handed back, it is effectively defining the customer’s detection posture. That is a control decision with risk implications, especially when the customer’s own risk tolerance is higher than the provider’s throughput model. Teams should reassert ownership over suppression criteria and investigation thresholds.
Evidence portability is the hidden requirement in MDR. If the queries, context, and reasoning stay inside the provider’s workflow, the organisation loses both auditability and institutional knowledge when analysts change or the contract ends. That makes the closed-case ticket a poor substitute for a reusable investigation record. Practitioners should insist that evidence chains remain theirs.
Alert-level transparency is now a board-relevant control issue. The question is no longer whether the service has coverage, but whether the service can show what it did with each alert, when it acted, and why it reached the conclusion it did. That is especially relevant for identity signals such as unusual authentications, service-account behaviour, and privileged activity. Teams should evaluate MDR through the lens of controllability, not just service presence.
Managed detection is exposing a visibility debt. The deeper problem is that many organisations have outsourced the act of understanding alerts, not just the act of receiving them. When alert handling is opaque, the programme accumulates security debt in the form of unreviewed decisions and non-transferable context. Practitioners should treat that debt as an operational risk to be reduced, not a reporting gap to be accepted.
What this signals
Alert triage is becoming an accountability boundary. Security teams should stop treating MDR as proof that detection is working and start treating it as a managed decision layer that must be auditable. If the provider cannot expose what was suppressed, what was investigated, and why, the programme has outsourced visibility without outsourcing risk.
Investigation transparency is now part of identity governance. Identity-related alerts often signal privilege misuse, unusual authentication, or service-account abuse, and those signals lose value if they are filtered before review. Teams that depend on MDR need a control path for evidence retention and reviewability, not just escalation summaries.
For practitioners
- Audit alert-level investigation completion Ask the provider to show the percentage of alerts fully investigated, enriched-and-handed-back, or auto-closed in the last quarter, not just the total volume handled.
- Measure time to investigation completion Track median time from alert receipt to investigation completion, because acknowledgment time alone does not show whether the threat was actually examined.
- Review suppression and tuning decisions Obtain the full list of detections currently suppressed, tuned out, or deprioritised on your account, and confirm who authorised each decision.
- Require evidence-chain exportability Insist that closed investigations include the queries run, evidence collected, and reasoning used, so your team can validate and reuse the decision.
- Reprice noisy alert classes Separate base subscription pricing from per-investigation charges for phishing, identity, and other high-volume alerts so cost reflects outcome, not backlog pressure.
Key takeaways
- MDR reporting can conceal the real control failure, which is incomplete investigation of alerts rather than a lack of dashboard visibility.
- The strongest evidence in the article is that roughly 40% of alerts may go uninvestigated and around 57% of organisations suppress or tune detections to cut noise.
- Practitioners should test MDR on investigation depth, time to completion, and evidence portability, because those are the controls that determine whether the service is truly usable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | The article is about whether alerts are actually monitored and investigated rather than merely reported. |
| RS.AN-01 — Notifications From Detection Systems | Alert handback, escalation, and analysis timing are central to the article's managed-response gap. | |
| Recommendation — Map MDR reporting to DE.CM-01 and verify that alerts are actively monitored, not just counted. Use RS.AN-01 to confirm that detection outputs trigger meaningful analysis, not opaque closure. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The article's core issue is whether investigation evidence and reasoning remain reviewable. |
| Recommendation — Apply AU-6 to require reviewable investigation evidence and defensible closure decisions. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Closed alerts without evidence chains weaken the ability to review what the MDR actually did. |
| Recommendation — Use CIS-8 to preserve investigation logs, queries, and analyst decisions for later review. | ||
| MITRE ATT&CK | TA0007;TA0006 — Discovery; Credential Access | The article references identity alerts and suspicious activity that can hide credential-driven compromise. |
| Recommendation — Map missed identity alerts to TA0007 and TA0006 so detection gaps are assessed against real attacker behaviour. | ||
Key terms
- Managed Detection And Response: MDR is a service model focused on detecting suspicious activity, investigating alerts, and helping contain attacks across threat-facing technologies. It is designed to turn telemetry into action, which makes it closer to security operations than simple platform administration.
- Alert-level investigation: The process of reviewing an individual security alert far enough to support a defensible conclusion. It includes enrichment, analyst reasoning, and evidence retention, not just acknowledgement or closure. In managed detection models, this is the control point that determines whether the service produced a real decision or only a summary.
- Evidence Chain: An evidence chain is the connected sequence of records that proves an identity action was requested, approved, executed, and reconciled. Without that continuity, access governance becomes fragmented and auditors are left to infer intent from incomplete system data.
- Detection suppression: A control decision that reduces, filters, or disables alerts to lower noise or workload. Suppression can be necessary, but it becomes risky when it hides meaningful signals, changes the meaning of coverage reporting, or is applied without customer visibility.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps identity and security practitioners build programmes that are auditable, policy-driven, and resilient under real-world operational pressure.
Published by the NHIMG editorial team on August 1, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org