Conifers finds 47% of the average organization's detections need attention despite showing as deployed

Three of the five categories leave a technique with no working alert ^[3]. A logic bug means the rule runs but cannot fire when the technique is used, because of a wrong operator, broken parsing or a condition that can never be true ^[4]. Missing telemetry means the rule runs against a data source that stopped flowing or changed format, or was never onboarded ^[5]. A rule that queries a table or index without the events it needs still looks healthy on every dashboard ^[6].

"The underlying problem with threat detection isn't that detections were poorly written. It's that the telemetry beneath them changes, making detections stale and ineffective without anyone realizing it," said Rutger de Boer, CTO at DTX ^[10]. He said the research "validates what we see with our customers every day" ^[11].

The last two categories are about volume. Duplicated detections cover the same behavior with slight variations, adding alert volume and maintenance work without adding coverage ^[7]. Noisy detections fire so often and with so little precision that analysts learn to ignore them ^[8]. The published findings do not break the 47% down by category or say how many organizations contributed. The share of rules that would stay silent during an intrusion cannot be read from the headline figure ^[2].

Coverage against known threats was measured separately. On average, organizations had matching detections, hunts or compensating visibility for 63% of the threats their own intelligence flagged as relevant ^[15]. That left 37% with none ^[16]. Scored against the ATT&CK techniques relevant to each organization, protection came in one point higher ^[19][20]. The researchers trace the gap to the manual, slow work of turning intelligence reports, feeds and briefings into detection logic and hunting hypotheses ^[17].

"For years, the industry has measured detection strength by counting rules and tools. But deployed is not the same as protected," said Tom Findling, CEO of Conifers ^[21]. De Boer said that by continuously testing detections at scale, organizations "gain confidence in their security posture while significantly reducing the manual effort required from analysts" ^[12].

The figures come from Conifers' own customer base ^[1]. The fix the researchers propose is AI that connects to threat intelligence and turns it into detections and hunts automatically, with detection engineers directing strategy ^[18].