Notifications
Clear all
Topic starter
18/08/2026 2:14 pm
TL;DR: SANS found that only 18% of detection teams say they are staying ahead of the threat landscape, while 56% say they are barely keeping pace and 24% are falling behind, according to Axoflow's analysis of the 2026 State of Detection Engineering survey. The underlying issue is not just rule-writing speed, but brittle data collection, schema drift, and weak validation that leave cloud-native environments undercovered.
NHIMG editorial — based on content published by Axoflow: Closing the Data-Detection Gap: What We're Building
By the numbers:
- Only 18% of detection teams say they are staying ahead of the threat landscape.
- 56% report barely keeping pace.
Questions worth separating out
Q: What breaks when detection teams automate rules before fixing telemetry quality?
A: They get faster rule deployment on top of unstable inputs.
Q: Why do cloud-native environments create more blind spots for security teams?
A: Cloud-native systems change too quickly for static collection assumptions.
Q: How do teams know if detection engineering is actually improving?
A: They should measure whether new detections survive variant testing, whether telemetry is complete enough to support triage, and whether alerts feed back into updated logic without long delays.
Practitioner guidance
- Map telemetry dependencies before tuning detections Identify which identity, workload, and cloud events must be captured for your highest-value detections, then test whether each source survives rescheduling, replatforming, and schema drift.
- Add automated validation to detection-as-code pipelines Run rules against representative cloud-native data and known attack patterns so field mapping failures and broken assumptions are caught before deployment.
- Treat normalization as a control, not a cleanup task Assign ownership for schema stability, field mapping, and event classification inside the detection workflow instead of routing every breakage through a separate data team.
What's in the full article
Axoflow's full article covers the operational detail this post intentionally leaves for the source:
- How its in-stream detection pipeline classifies, normalizes, and routes events before SIEM ingestion
- The early-access detection capability and the rollout timing toward September and Q4 shipping
- The way Sigma rules are tested against live ATT&CK vectors inside the pipeline
- The specific data engineering and schema-drift handling approach behind its detection layer
👉 Read Axoflow's analysis of the data-detection gap in cloud-native security →
Cloud-native detection blind spots: what security teams need to act on?
Explore further
18/08/2026 3:06 pm
Detection coverage is now a data engineering problem first. Security teams often treat rule content as the primary unit of improvement, but the article shows that detection quality is constrained earlier in the chain. Schema drift, unstable event fields, and brittle collection are what make cloud-native blind spots persist. The practitioner conclusion is clear: if the data layer is unstable, better rules only produce faster failure.
A question worth separating out:
Q: How should security teams govern telemetry pipelines that handle identity and cloud logs?
A: Treat the pipeline as a control layer, not a transport layer. Governance should cover schema resilience, in-flight redaction, lineage, routing authority, and retention decisions. If identity and cloud logs are transformed after storage, you lose both cost leverage and control fidelity. The practical goal is to make data quality and routing decisions before the SIEM bills you for raw ingestion.
👉 Read our full editorial: Data-detection gaps are widening as cloud-native environments reshape logs
