Rethinking MDR as Attackers and Defenders Embrace AI – CYBERDEFENSA.MX
admin Noticias, Trending
Rethinking MDR as Attackers and Defenders Embrace AI – CYBERDEFENSA.MX

For most of the past decade, managed detection and response was the answer to a real problem. Security teams couldn’t staff around the clock, couldn’t hire enough analysts, and needed someone else to handle the alert queue. MDR stepped in. It worked well enough. Until now.

The threat landscape has changed faster than the MDR model can adapt. Attackers are using AI to move faster, generate more convincing phishing at scale, automate reconnaissance, and create malware variants that evade signature-based detection. The attack surface has expanded from endpoint to cloud, identity, and network simultaneously. And yet MDR is still doing what it always did. Routing alerts to human analysts who triage what they can, in the order they can get to it.

That is no longer enough. The data we share below proves it and security leaders might consider exploring whether they have outgrown their MDR.

MDR’s 24/7 promise doesn’t cover 60% of your alerts

MDR promised 24/7 human coverage. What it delivered was a 24/7 human capacity to triage high-severity alerts. Those are not the same thing.

Across the industry, approximately 60% of alerts go unreviewed. That’s not a performance failure. Human teams, whether in-house or outsourced to an MDR, cannot process the volume of alerts that modern environments generate. So they do what any rational person does. They prioritize. P1s and P2s get worked. P3s and P4s pile up.

But this is exactly where attackers hide.

Analysis of 25 million alerts across global enterprises in 2025 found that nearly 1% of real threats originate in low-severity and informational alerts. In an enterprise generating 450,000 alerts annually, that translates to roughly 54 real incidents per year, about one per week, sitting in the deprioritized queue where no one is looking.

The breaches hiding in that backlog are not theoretical. They are happening right now, in organizations that believe they have coverage.

Note: The math behind the above statement assumes 450K annual alerts, of which 60% are not investigated and of those, 2% are real incidents. Of those real incidents, 1% originate in low-severity alerts.

Investigation quality varies by who is on shift

Even for alerts that do get reviewed, MDR investigation quality is not consistent. It is bounded by the experience of the analyst on duty, the queue depth at that moment, the time of day, and whether the team is fully staffed. A P1 at 3 am gets a different investigation than the same alert at 10 am.

This is not a criticism of MDR analysts. It is a description of what happens when any human-executed process runs at high volume, under pressure, around the clock. Variance is unavoidable.

The consequences are real. When an investigation is shallow, threats get classified as noise. When follow-through is inconsistent, early-stage lateral movement looks like routine behavior. The attacker who got in on a low-severity alert keeps moving undetected because no one had the time or context to connect the signals.

Detection engineering is not a closed loop

In most MDR deployments, detection engineering is a periodic exercise. Rules get tuned when customers complain about alert volume. New coverage gets added when a major CVE makes news. Otherwise, the detection posture drifts.

The core problem is architectural. MDR investigation and detection engineering operate in separate silos. When an analyst investigates an alert and closes it as a false positive, that insight rarely feeds back into the detection system. Broken rules stay broken. Noisy rules keep generating noise. New attacker techniques arrive without matching detections.

The result is a detection posture that degrades faster than it improves. Real coverage, measured against the MITRE ATT&CK framework, can be far lower than teams assume.

You can’t audit what you can’t see

Most MDR services are a black box. Customers receive escalations and summaries. They do not get to see the investigation logic, inspect the evidence trail, verify the verdict, or audit what the analyst actually reviewed before closing a case.

In an era where accountability and transparency are security requirements, this is a genuine liability. When an incident is missed, you cannot diagnose why. When a verdict is wrong, you cannot trace the reasoning. When regulators ask what was investigated and how, there is no answer.

The AI savings are going to the vendor, not to you

AI is reducing the operational cost of MDR. Providers are using it to automate portions of triage, reduce analyst hours, and increase margins. Those efficiency gains do not flow through to customers as lower prices or expanded coverage. The buyer still pays the same rate, or more. The provider keeps the savings.

But the coverage gap stays the same. The human scaling constraint stays the same. Only the provider’s cost structure has improved.

You don’t own what was built in your name

Detection rules, triage logic, case history, and investigation learnings accumulate inside the MDR vendor’s platform over the life of the contract. When the contract ends, that knowledge does not move with you. The years of tuning, the accumulated context about your environment, and the detection improvements built from your data all stay with the vendor.

This creates two problems. First, organizations that switch providers start from scratch, rebuilding institutional knowledge that took years to develop. Second, organizations that want to bring security operations in-house, a trend that is accelerating as AI SOC tools mature, find themselves starting with no foundation.

MDR providers, for obvious reasons, are not incentivized to help customers build internal capability. Their model depends on retaining the work.

Your MDR contract may block you from using Claude for your SOC

The above-mentioned knowledge lock-in is no longer just a switching-cost problem. It’s also an AI readiness problem. When you try to deploy an AI agent for SOC work, it needs a knowledge foundation to reason over. Detection rules, case history, behavioral baselines, and forensic verdicts. If those live in your MDR vendor’s platform, your agent is starting from near zero.

Additional MDR gaps worth noting

Aside from the above, MDR has a set of smaller gaps that compound over time. Every customer gets the same generic playbook regardless of their specific risk profile, compliance obligations, or data sensitivity. Integration tools like SOAR, which were supposed to streamline MDR findings into internal workflows, largely failed to deliver on that promise because human-driven investigation doesn’t produce the structured, consistent outputs that automation requires. And when a real incident surfaces and a customer needs to talk to someone who understands their environment, they often reach an AI chatbot or a ticketing queue instead of a person.

What the AI-powered attacker era actually requires

The attackers of 2026 are not waiting for alert queues to clear. AI-generated phishing campaigns hit inboxes at a volume and quality that bypass conventional gateways. Credential stealers like Agent Tesla and LummaC2 move fast. EDR tools are being actively evaded, with research showing that more than half of confirmed compromised endpoints had already been marked as «mitigated» by the EDR vendor. The attacker has already won a round that the defender didn’t know was being played.

Meeting this moment requires a different operating model. One where investigation speed is measured in seconds, not hours. Where every alert gets examined, regardless of severity or time of day. Where the output is an evidence-backed verdict, not an analyst’s judgment call under pressure.

This is what an AI SOC is designed to deliver.

An operating model shift where AI executes and humans supervise

The core idea behind an AI SOC is simple. Move investigative execution out of the human queue and into AI, so that humans can focus on decisions rather than discovery.

In practice, this means 100% of alerts, including endpoint, identity, cloud, network, phishing, and SIEM, are triaged and investigated automatically. Not sampled. Not filtered by severity. All of them. The AI applies the same forensic depth to a P4 alert at 3 am that a senior analyst would apply to a P1 in the afternoon.

Intezer’s platform data across 25 million alerts shows this is achievable. Less than 2% of alerts required human escalation. The over 98% that resolved autonomously did so with sub-minute median triage time and 98% verdict accuracy. For a large enterprise with 450K annual alerts, that means roughly 441K alerts per year are fully investigated and resolved without human intervention and 54 genuine threats that would have been missed under traditional MDR coverage are now caught with actional remediation recommendations.

Forensic depth is what makes AI autonomy trustworthy

AI can summarize an alert. That’s useful. AI can enrich with threat intelligence. Also useful. But neither of those activities is investigation. They are pre-processing.

Genuine AI-driven investigation requires forensic-level interrogation. When an alert fires, the question is not «does this look suspicious?» It is, what actually executed, where did it originate, what did it do, and is there evidence of compromise in memory that the alert itself didn’t surface?

This matters because the most dangerous threats are specifically designed to evade surface-level detection. Fileless malware lives entirely in memory and writes nothing to disk. Code injection hides inside legitimate processes. Early-stage credential theft looks like normal authentication. Without memory forensics, binary analysis, and code reuse detection, an AI investigation is only as deep as the alert data it was handed.

Forensic depth is also what creates the trust threshold, the point at which AI verdicts are accurate and evidence-backed enough to act on without human validation. Below that threshold, AI assists analysts. Above it, AI can safely take on the full investigative workload and escalate only when evidence warrants it.

Closed-loop detection engineering changes everything

One of the most significant structural advantages of a true AI SOC is the closed loop between investigation and detection. Every alert investigation surfaces information about detection quality. Which rules are firing accurately, which are generating noise, and which attacker techniques have no coverage at all?

When this feedback flows continuously into detection engineering, the posture improves without waiting for an annual audit or a customer complaint. Noisy rules get tuned. Broken telemetry gets flagged. New coverage for emerging techniques gets deployed in days, not months. The detection system gets smarter alongside the investigation system.

This is how MITRE ATT&CK coverage moves from a static baseline to a dynamic, improving map of what an organization can actually detect. It is the difference between coverage that reflects what was set up two years ago and coverage that reflects what attackers are doing today.

Pricing that aligns with full coverage

The economics of an AI SOC should match the coverage it provides. Per-alert pricing, still common among AI copilot tools that rely heavily on LLMs, forces customers to be selective about which alerts to send. The result is the same cherry-picking problem that MDR created. High-severity alerts get the attention, low-severity alerts accumulate in a deprioritized queue.

Per-endpoint pricing changes this entirely. The cost is fixed to the number of monitored endpoints, not to alert volume. There is no economic penalty for investigating every alert. Full coverage becomes the default, not a premium option.

This also matters for budget predictability. Alert volumes spike unpredictably during active incidents or when new detections deploy. Endpoint counts are stable. For finance teams trying to plan security spend, the difference is significant.

What ownership looks like under an AI SOC

Detection rules, investigation history, and organizational context should belong to the organization, not to the vendor. This means every detection deployed to a customer’s SIEM is the customer’s rule. Investigation evidence is available for audit at any time. If the organization decides to expand internal capability, build its own AI agents, or switch tools, they take everything with it.

This is not just a contract term. It is a prerequisite for security maturity and for broader adoption of AI tools like Claude for your security team. Organizations that want to eventually supervise AI systems rather than outsource to vendors need a knowledge foundation to build on. That foundation cannot exist if it lives inside a vendor’s platform.

The transition from MDR to AI SOC

Moving from MDR to an AI SOC is not necessarily a rip-and-replace decision for most organizations. The practical path might be augmentation first. Bring in an AI investigation alongside the existing MDR contract, observe what the AI surfaces that the MDR was missing, and let the comparison build the case for a clean transition at renewal.

By the time the MDR contract is up for renewal, the organization typically has months of evidence showing what full alert coverage looks like, what the escalation rate was under AI triage, and what it would cost to maintain the old model versus the new one. The decision is no longer theoretical.

The question security leaders need to answer

The MDR model was designed for a world where attackers operated at human speed, and the primary challenge was staffing coverage. That world is gone. Attackers are running AI-assisted campaigns, moving through environments faster than human triage queues can respond, and specifically targeting the low-severity signal space where MDR leaves blind spots.

The question for every CISO and security leader evaluating their current operations is straightforward. Of the 60% of alerts your team isn’t reviewing, how confident are you that none of them contain a real threat?

The answer, informed by Intezer’s analysis of 25 million real alerts, is that roughly 54 of them do. Every year. One per week. In the pile that no one is looking at.

The AI SOC doesn’t promise to eliminate all threats. No platform does. But it closes the coverage gap that the MDR model structurally cannot. Every alert, every severity, every hour of the day, is investigated with forensic depth, in under a minute. That is what security operations in the AI era look like.

Found this article interesting? See the 2026 MDR renewal checklist by Intezer.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Attackers Don’t Just Send Phishing Emails. They Weaponize Your SOC’s Workload – CYBERDEFENSA.MX
admin Noticias, Trending
Attackers Don’t Just Send Phishing Emails. They Weaponize Your SOC’s Workload – CYBERDEFENSA.MX

The most dangerous phishing campaigns aren’t just designed to fool employees. Many are designed to exhaust the analysts investigating them. When a phishing investigation takes 12 hours instead of five minutes, the outcome can shift from a contained incident to a breach.

For years, the cybersecurity industry has focused on the front door of phishing defense: employee training, email gateways that filter known threats, and reporting programs that encourage users to flag suspicious messages. Far less attention has been paid to what happens after a report is filed, and how attackers exploit the investigation process that follows. 

Alert fatigue in Security Operations Centers isn’t just an operational inconvenience. It can become an attack surface. SOC teams increasingly report phishing campaigns that appear designed not only to compromise targets but also to overwhelm the analysts responsible for investigating them. 

This shifts how organizations should think about phishing defense. The vulnerability isn’t just the employee who clicks. It’s also the analyst who can’t keep up with the queue. When investigations that should close in minutes stretch to 3, 6, or 12 hours because of queue congestion, the window for attacker success widens dramatically.

When Phishing Volume Becomes a Weapon

Phishing is often treated as a series of independent threats. One message. One potential victim. One investigation. Attackers operating at scale think in terms of systems, not individual messages. A SOC is one of those systems, and it has finite capacity and predictable failure modes.

Consider a phishing campaign targeting a large enterprise. The attacker sends thousands of messages. Most are low-sophistication lures that email gateways or trained employees will likely catch. These messages flood the SOC with reports and alerts. Analysts begin triaging, working through a queue that grows faster than they can clear it.

Buried in that volume are a few carefully crafted spear-phishing messages targeting individuals with access to critical systems. These messages are the real payload. The flood is not just a numbers game. It is effectively a denial-of-service attack against the SOC’s attention, sometimes referred to as an Informational Denial-of-Service (IDoS).

This pattern is not purely theoretical. Red team exercises and incident reports have documented adversaries who time high-volume phishing campaigns to coincide with targeted spear-phishing attempts. The commodity wave creates noise. The targeted message hides inside it. 

The Predictable Failure Mode

This tactic works because SOC phishing triage tends to follow a predictable pattern across organizations. When phishing report volume spikes, most SOCs respond in predictable ways. Analysts begin triaging faster, spending less time per submission. Investigation depth decreases. Industry research shows 66% of SOC teams cannot keep up with incoming alerts. The focus shifts from thorough investigation to clearing the queue. Managers may deprioritize phishing reports relative to alerts from other detection systems, assuming user-submitted reports are lower fidelity.

Each response is rational on its own. Together, they create the conditions an attacker needs.

SOC managers observe a consistent pattern during high-volume periods: decision quality drops as workload increases. Analysts begin anchoring on superficial indicators. Messages that «look like» previously benign submissions receive less scrutiny. Novel indicators of compromise may be overlooked when they appear in a crowded queue rather than in isolation.

The attacker’s advantage compounds because the most dangerous messages are specifically designed to exploit these shortcuts. A spear-phishing email targeting the CFO’s executive assistant doesn’t arrive looking dramatically different from everything else in the queue. It’s crafted to resemble the category of messages that analysts, under pressure, have learned to move past quickly — a vendor communication, a document-sharing notification, a routine business process email.

The Economics Behind the Attack

The economics of this dynamic heavily favor the attacker. Generating thousands of commodity phishing emails costs almost nothing, especially with generative AI lowering the production barrier further. But each of those emails, once reported by an employee, costs the defending organization real analyst time and cognitive bandwidth.

This creates an asymmetry that traditional SOC models have no good answer for:

  • Attacker cost per decoy email: near zero. Template-based generation, commodity infrastructure, automated delivery.
  • Defender cost per reported email: minutes of skilled analyst time for even a cursory review. Hours if the investigation is thorough.
  • Attacker cost for the real payload: moderate — these are the carefully researched, individually crafted messages designed for specific targets.
  • Defender cost of missing the payload: potentially catastrophic — credential compromise, lateral movement, data exfiltration, ransomware deployment.

The defender is forced to investigate everything because the cost of missing a real threat is so high. The attacker knows this and uses it to drain investigative resources before the real attack arrives. It’s an attrition strategy applied to human attention rather than system availability.

This asymmetry has only worsened as organizations have scaled up phishing awareness programs. More trained employees means more reports. More reports means more queue pressure. More queue pressure means less attention per investigation. The very success of security awareness training has, paradoxically, expanded the attack surface that adversaries exploit.

The Real Problem is Decision Speed

Most security tools respond to this challenge by throwing more alerts at people — additional detection layers, more threat feeds, extra scoring systems. More data without better decision processes only compounds the overload. The fundamental issue isn’t that SOCs lack information about suspicious emails. It’s that they lack the ability to turn that information into clear, confident decisions at the speed the threat environment demands.

The organizations breaking out of this cycle are reframing phishing triage not as an email analysis problem but as a “decision precision” problem. The goal isn’t to generate more signals about a suspicious message. It’s to deliver a decision-ready investigation — a complete, reasoned verdict that tells the analyst exactly what was found, what it means, and what should happen next — so that no one has to guess.

This distinction matters because guessing is exactly what overwhelmed analysts are forced to do. When the queue is deep and investigation time is compressed, analysts make judgment calls based on incomplete analysis. Sometimes they’re right. Sometimes they’re not. And the attacker’s entire strategy depends on those moments when they’re not.

Decision-ready investigation changes the equation. Instead of presenting analysts with raw indicators and expecting them to assemble a conclusion under time pressure, the system delivers a synthesized assessment with clear reasoning. The analyst’s role shifts from doing the investigation to reviewing the investigation — a fundamentally different cognitive task that scales far more effectively under volume.

Why Rule-Based Automation Doesn’t Solve This

The obvious response is automation, and most SOCs have implemented some version of it. Auto-closing reports from whitelisted senders. Deduplicating identical submissions. Applying basic reputation checks to filter known-safe domains.

These measures help with baseline volume but fail against the specific threat model described above — and in some cases, they make it worse.

Rule-based filters create predictable blind spots. If an attacker knows (or can infer) that an organization auto-closes reports from domains with established reputation, they can compromise or spoof those domains. If deduplication logic groups messages by subject line or sender, an attacker can vary these superficially while maintaining the same malicious payload.

There’s also the trust problem. Security teams are rightfully skeptical of «black box» automation that renders verdicts without showing its work. When an automated system closes a phishing report, and no one can explain exactly why, confidence erodes. Analysts second-guess the automation, re-investigate cases it already handled, or override its decisions reflexively. The efficiency gains evaporate, and the organization ends up with the worst of both worlds: automation it’s paying for and manual processes it can’t abandon.

More fundamentally, static rules can’t adapt to the dynamic relationship between attack patterns and SOC behavior. The attacker’s strategy isn’t static. It continuously evolves based on what works. A defensive system built on fixed rules is playing a static game against a dynamic adversary.

Specialized Investigation Agents, Not Black Boxes

The emerging approach to adversarial phishing defense looks less like a single automated tool and more like a coordinated team of specialized experts — each focused on a specific dimension of the investigation and each capable of explaining exactly what it found and why it matters.

In practice, this means agentic AI architectures where distinct analytical agents handle different parts of a phishing investigation simultaneously. One agent verifies sender authenticity — checking SPF, DKIM, and DMARC records, analyzing domain registration history, and evaluating whether the sending infrastructure matches the claimed identity. Another examines the message itself, analyzing linguistic patterns, tone inconsistencies, and social engineering indicators that suggest manipulation rather than legitimate communication. A third correlates the report with endpoint telemetry, determining whether the recipient’s device has exhibited any behavioral anomalies that might indicate a payload has already executed.

These agents don’t operate independently and disappear into a verdict. They produce transparent, auditable reasoning — a clear chain of evidence showing which indicators were evaluated, what was found, and how those findings contributed to the final assessment. When the system determines a message is benign, it shows why. When it flags a message as malicious, it presents the specific evidence. When signals conflict, it explains the ambiguity and escalates with full context.

This transparency is what separates decision-ready investigation from black box automation. An analyst reviewing an AI-generated investigation can see the logic, challenge the reasoning, and build calibrated trust in the system over time. That trust is what ultimately allows organizations to let the system handle routine verdicts autonomously — not blind faith in an opaque algorithm, but earned confidence in a process that shows its work.

The Five-Minute Reality

The practical impact of this approach comes down to time — specifically, the difference between the 3-to-12-hour investigation timelines that characterize most manual SOC phishing workflows and the sub-five-minute resolution that decision-ready AI triage enables.

This gap is not only an efficiency metric. It directly affects security outcomes. In 12 hours, a compromised credential can be used for lateral movement, privilege escalation, and data staging. In five minutes, the same credential gets revoked before the attacker establishes persistence. A “non-event.” The same phishing email produces radically different consequences depending entirely on how fast the investigating organization reaches a confident decision.

When cognitive AI handles initial investigation, every submission gets the same rigorous, multi-dimensional analysis regardless of queue depth or time of day. The commodity phishing flood designed to exhaust analysts gets absorbed by a system that doesn’t fatigue. The carefully crafted spear-phish designed to blend in during high-volume periods receives the same thorough investigation as every other submission, with cross-submission pattern detection that might flag it precisely because of its relationship to the surrounding volume.

The human analysts, the experienced, skilled professionals that every SOC depends on, shift from reactive queue processing to the work that genuinely requires human judgment: investigating confirmed incidents, hunting for threats that haven’t triggered alerts, and making strategic decisions about defensive posture.

Measuring SOC Resilience

Organizations that adopt this framing need metrics that reflect it. Traditional SOC metrics, such as mean time to acknowledge, mean time to close, and tickets processed per analyst, measure operational efficiency. They don’t measure resilience against adversarial exploitation.

Metrics that capture defensive resilience against weaponized volume include:

  • Investigation quality consistency under load. Does analytical depth remain constant as report volume increases, or does it degrade? Tracking investigation thoroughness across volume quartiles reveals whether the SOC’s phishing triage is exploitable under pressure.
  • Decision latency. How quickly does the triage system move from alert receipt to confident verdict? The gap between 12 hours and 5 minutes isn’t an incremental improvement; it’s a categorical change in attacker opportunity.
  • Escalation accuracy at volume. When the queue is heavy, are the right cases being escalated to human analysts? Rising false negative rates during high-volume periods indicate exactly the vulnerability attackers target.
  • Decision transparency rate. What percentage of automated verdicts include complete, auditable reasoning? Black box resolutions that can’t be explained are resolutions that can’t be trusted, and untrusted automation gets overridden, negating its value.
  • Proactiveness. How close to the point of impact are threats being identified?

Changing the Defensive Equation

The attacker’s advantage in weaponizing SOC workload depends on a specific assumption: that increasing phishing volume reliably degrades defensive quality. If that assumption holds, the strategy is highly effective and nearly free to execute. If it doesn’t — if investigative quality and speed remain constant regardless of volume — the entire approach collapses.

The commodity phishing flood no longer provides cover because every message receives the same analytical rigor in the same five-minute window. The carefully crafted spear-phish no longer benefits from a rushed analyst because no analyst is rushing. The asymmetry flips: the attacker spent resources generating noise that achieved nothing, while the defender’s capacity for genuine threat detection remained intact.

The strategic value of decision-ready AI triage is not just efficiency. It removes a failure mode that attackers have learned to exploit. It turns a predictable vulnerability into a defensive strength, making the SOC’s phishing workflow resilient against the very tactic designed to break it.

The phishing report button stays. Employees keep reporting. But the investigation engine behind that button no longer offers attackers a lever to pull.

Conifers.ai’s CognitiveSOC platform uses agentic AI to deliver decision-ready phishing investigations in minutes, not hours. Learn more about how the Conifers platform is designed to reduce the alert-fatigue conditions attackers often exploit.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.