Topic starter
06/11/2026 6:36 pm
TL;DR: Falling storage and token costs are pushing security teams toward higher-recall detection, according to Cotool, because agents can now triage far more telemetry and even investigate every login without the human bottleneck that once constrained response. The governance shift is from selective alerting to scalable evidence collection, where recall becomes the primary design choice.
Editorial analysis by NHI Mgmt Group, based on content published by Cotool: “Jevons for Cybersecurity”.
Key questions
Q: How should teams use authentication telemetry for high-recall detection?
A: Use authentication telemetry to detect risky identity behaviour by correlating login, token, and session activity across users, service accounts, and privileged accounts.
Q: Why does cheaper triage change security alerting strategy?
A: Cheaper triage changes security alerting strategy because the organisation can afford to inspect more signals, raise recall, and keep lower-confidence detections that would otherwise be dropped.
Q: How do agents improve detection and response operations?
A: Agents improve detection and response operations by automating repetitive investigation steps, enriching alerts, and executing bounded remediation actions such as containment, ticket creation, or credential revocation.
Practitioner guidance
- Prioritise broad authentication review Move high-value sign-in, token, and session events into an always-on review queue so broad compromise signals are not missed because a rule was too selective.
- Tune detections for recall where compromise is costly Accept more false positives in the parts of the environment where missed compromise would be materially worse than extra analyst work, then automate the first-pass triage.
- Feed every investigation back into detection logic Capture the outcome of agent-run reviews and fold those findings into tuning, allowlists, and rule refinement so the next detection pass is sharper.
Bottom line: Cheaper storage and agent triage are changing detection from a scarce human service into a scalable control surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
High-recall detection is becoming a governance choice, not just a technical one. Once agents can triage at scale, teams are no longer forced to equate affordability with narrow coverage. That changes how identity, cloud, and SOC programmes should define acceptable visibility thresholds, especially around authentication and access events. Practitioners should treat recall as a managed control objective rather than an aspirational tuning parameter.
A question worth separating out:
Q: What is the best way to reduce missed compromise in identity logs?
A: Use identity telemetry to correlate authentication events, device posture, privilege changes, and session behaviour so compromises are detected even when a password is not obviously abused. The best coverage comes from joining directory logs, MFA events, token issuance, and administrative actions, then alerting on unusual combinations that single logs miss.
👉 Read our full editorial: Agentic triage is making high-recall detection affordable