Topic starter
02/08/2026 11:47 am
TL;DR: XDR has improved detection and correlation, but SOC teams still spend about 70 minutes investigating each alert while enterprise volumes remain far above human capacity, according to D3 and industry research cited in the article. The structural gap is investigation and response, not visibility, so automation must extend beyond alert reduction.
Editorial analysis by NHI Mgmt Group, based on content published by D3: “MITRE Gave XDR a Perfect Score. Then the Analyst Had to Investigate Alone”.
By the numbers:
- Leading XDR platforms scored 100% technique-level detection in the 2025 MITRE ATT&CK Evaluations.
- Enterprise SOCs receive an average of 960 alerts per day.
Key questions
Q: Why do XDR alerts still overwhelm SOC teams after correlation improves?
A: Correlation reduces noise, but it does not remove the work of proving whether an incident is real, tracing the attack path, and deciding containment.
Q: What breaks when investigation capacity is lower than alert volume?
A: The SOC stops treating all correlated incidents as equally actionable.
Q: How can organisations tell whether XDR visibility is actually working?
A: Look for whether analysts can find, enrich, and pivot across recent and historical telemetry without manual export steps or missing coverage.
Practitioner guidance
- Define investigation capacity as a control objective Track how many alerts your SOC can fully investigate per day, and compare that number with real alert intake rather than with raw detection volume.
- Instrument identity context in incident workflows Make sure analysts can see user, service account, and delegated access evidence in the same workflow as the correlated incident, so triage is not delayed by manual context gathering.
- Separate response automation from investigation automation Use containment actions only after the investigation layer has established scope and confidence, because isolation and blocking decisions are not the same as determining what happened.
Bottom line: XDR has improved alert correlation, but the SOC still needs enough investigation capacity to validate and scope incidents before response starts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:57 pm
Investigation, not detection, is now the SOC’s primary capacity problem. XDR has materially reduced alert noise, but the article shows that the analyst workload shifts rather than disappears. The limiting factor is the ability to validate, scope, and coordinate response across tools and identities. For practitioners, that means measuring security effectiveness by investigation completion, not by correlation quality alone.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should SOC teams do when detection is strong but investigations still lag?
A: They should add an investigation layer that can reason across telemetry, identity, and response context, then route only the cases that genuinely need human judgement. The goal is to reduce manual triage bottlenecks, not to replace detection or over-automate containment without evidence.
👉 Read our full editorial: XDR visibility is improving, but investigation remains the SOC bottleneck