One Missed Threat Per Week: What 25M Alerts Reveal About Low-Severity Risk

"The dark secret of enterprise security operations is that defenders have quietly institutionalized the practice of not looking. This is not just anecdotal, but rather backed by a recent report investigating more than 25 million security alerts, including informational and low-severity, across live enterprise environments."

"The patterns that emerge from this data tell a consistent story. Threat actors are exploiting the predictable gaps created by constrained, severity-based security operations, and they are doing it systematically. Understanding where those gaps actually live requires looking at the full alert picture, starting with the category most teams have been conditioned to ignore."

"In this analysis of 25M alerts, nearly 1% of confirmed incidents originated from alerts initially classified as low-severity or informational. On endpoints specifically, that figure climbed to nearly 2%. At enterprise scale, percentages like these are not noise. The average organization generates approximately 450,000 alerts per year. One percent of that is roughly 54 real threats annually, about one per week, that never get investigated under a traditional SOC or MDR model."

"These are not theoretical risks sitting at the edge of an attacker's wishlist. They are real compromises hiding in the category of alerts that operations teams have been trained to deprioritize. Endpoint findings from the report deserve special attention because they challenge a foundational assumption in most security programs: that EDR remediat"

Defenders have institutionalized not looking at low-severity and informational security alerts. A report analyzing more than 25 million alerts across live enterprise environments found that threat actors exploit predictable gaps created by severity-based triage constraints. The dataset included 10 million monitored endpoints and identities, 82,000 forensic endpoint investigations with live memory scans, 180 million files analyzed, and telemetry from millions of IP addresses, domains and URLs, plus over 550,000 phishing emails. Nearly 1% of confirmed incidents began as low-severity or informational alerts, rising to nearly 2% on endpoints. With about 450,000 alerts per year per organization, this equates to roughly 54 real threats annually, about one per week, that are not investigated under traditional SOC or MDR models.

Read at The Hacker News