Topic starter
01/08/2026 10:44 pm
TL;DR: About 57% of organisations suppress or tune detections to cut noise, according to Prophet Security, which helps explain why MDR dashboards can look healthy while alert handling still falls short. MDR governance has to track investigation depth and evidence, not just closed tickets.
Editorial analysis by NHI Mgmt Group, based on content published by Prophet: “What Your MDR Isn't Telling You”.
By the numbers:
- A majority of organizations, around 57%, suppress or tune detection rules specifically to cut noise.
Key questions
Q: Why do suppressed detections create risk even when the MDR dashboard looks healthy?
A: Suppressed detections shift the security decision upstream, before a human analyst ever reviews the event.
A: Security teams should judge MDR on both detection quality and analyst workload, not on alert volume alone.
Q: What breaks when an MDR service claims coverage but not full investigation?
A: The control that breaks is assurance.
Practitioner guidance
- Audit alert-level investigation completion Ask the provider to show the percentage of alerts fully investigated, enriched-and-handed-back, or auto-closed in the last quarter, not just the total volume handled.
- Measure time to investigation completion Track median time from alert receipt to investigation completion, because acknowledgment time alone does not show whether the threat was actually examined.
- Review suppression and tuning decisions Obtain the full list of detections currently suppressed, tuned out, or deprioritised on your account, and confirm who authorised each decision.
Bottom line: MDR reporting can conceal the real control failure, which is incomplete investigation of alerts rather than a lack of dashboard visibility.
Glossary terms: Alert-level investigation, Managed Detection And Response, Evidence Chain, Detection suppression
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
01/08/2026 10:53 pm
Dashboard security is not investigation security. Managed-service reporting can prove that alerts were counted, escalated, or closed, but it cannot by itself prove that a meaningful investigation happened. That distinction matters because identity- and alert-driven threats are governed by evidence quality, not by volume metrics. Practitioners should treat summary dashboards as a starting point, not as assurance.
A question worth separating out:
Q: Should organisations keep MDR if they cannot export investigation context?
A: Only with caution. If the provider keeps the reasoning, queries, and institutional context inside its own workflow, the customer inherits dependency without portability. That creates switching friction and weakens auditability, so teams should treat context exportability as a contractual requirement, not a nice-to-have feature.
👉 Read our full editorial: What your MDR dashboard hides about alert-level investigation gaps