Topic starter
01/08/2026 10:44 pm
TL;DR: Roughly 40% of alerts are never investigated, while about 57% of organisations suppress or tune detections to cut noise, creating a gap between dashboard coverage and alert-level reality, according to Prophet Security. The real governance issue is not visibility alone, but whether investigation, timing, and evidence remain auditable under managed-service triage.
Editorial analysis by NHI Mgmt Group, based on content published by Prophet: “What Your MDR Isn't Telling You”.
By the numbers:
- A majority of organizations, around 57%, suppress or tune detection rules specifically to cut noise.
Key questions
Q: What breaks when an MDR service claims coverage but not full investigation?
A: The control that breaks is assurance.
Q: Why do suppressed detections create risk even when the MDR dashboard looks healthy?
A: Suppressed detections shift the security decision upstream, before a human analyst ever reviews the event.
A: Security teams should judge MDR on both detection quality and analyst workload, not on alert volume alone.
Practitioner guidance
- Audit alert-level investigation completion Ask the provider to show the percentage of alerts fully investigated, enriched-and-handed-back, or auto-closed in the last quarter, not just the total volume handled.
- Measure time to investigation completion Track median time from alert receipt to investigation completion, because acknowledgment time alone does not show whether the threat was actually examined.
- Review suppression and tuning decisions Obtain the full list of detections currently suppressed, tuned out, or deprioritised on your account, and confirm who authorised each decision.
Bottom line: MDR reporting can conceal the real control failure, which is incomplete investigation of alerts rather than a lack of dashboard visibility.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:53 pm
Dashboard security is not investigation security. Managed-service reporting can prove that alerts were counted, escalated, or closed, but it cannot by itself prove that a meaningful investigation happened. That distinction matters because identity- and alert-driven threats are governed by evidence quality, not by volume metrics. Practitioners should treat summary dashboards as a starting point, not as assurance.
A question worth separating out:
Q: Should organisations keep MDR if they cannot export investigation context?
A: Only with caution. If the provider keeps the reasoning, queries, and institutional context inside its own workflow, the customer inherits dependency without portability. That creates switching friction and weakens auditability, so teams should treat context exportability as a contractual requirement, not a nice-to-have feature.
👉 Read our full editorial: What your MDR dashboard hides about alert-level investigation gaps