Threat Detection Dashboards Mask Significant Security Coverage Gaps, Report Finds
A new report reveals that nearly half of threat detection rules deployed across various security tools are ineffective, failing to trigger during actual attacks despite appearing active on dashboards.
A recent analysis of over 14,000 threat detection rules has uncovered a critical flaw in modern cybersecurity defenses: many deployed rules are not actually protecting organizations as intended. The report, conducted by Conifers, found that a staggering 47% of threat detection rules across SIEM, endpoint, cloud, identity, email, and network security tools require immediate attention. These rules, while appearing active and functional on coverage dashboards, often fail to trigger when the specific techniques they were designed to detect are employed by attackers.
The failures identified by Conifers fall into five distinct categories. 'Logic bugs' occur when a detection rule is written incorrectly, preventing it from firing even when the targeted malicious activity is present due to faulty operators or parsing. 'Missing telemetry' happens when a detection rule relies on data sources that have stopped flowing, were never properly integrated, or have changed format without the rule being updated. Additionally, rules can query the wrong data tables or indexes, rendering them useless even if they appear healthy on monitoring dashboards. 'Duplicated detections' create unnecessary alert volume and maintenance overhead without adding value, while 'noisy detections' fire so frequently and imprecisely that security analysts learn to ignore them, effectively creating blind spots.
Compounding the issue, all five failure types share a common characteristic: they still present as deployed and operational on security coverage dashboards. This creates a false sense of security, leading organizations to believe they are protected when, in reality, significant gaps exist. Rutger de Boer, CTO at DTX, commented that the underlying problem isn't necessarily poor rule writing, but rather the dynamic nature of telemetry data, which can render detections stale and ineffective without anyone realizing it. "By continuously testing detections at scale, organizations gain confidence in their security posture while significantly reducing the manual effort required from analysts," de Boer added.
The report also highlighted challenges with vendor-supplied detections. Many security tools, including endpoint platforms, cloud security solutions, identity providers, and network sensors, ship with their own pre-built detections. Security teams often lack the ability to inspect or modify the logic of these vendor-controlled rules. This leaves them with limited options when such detections are noisy or ineffective: either suppress the rule and accept a potential blind spot, or allow it to continue flooding the security operations center (SOC) queue with irrelevant alerts.
Beyond the effectiveness of deployed rules, Conifers also measured the coverage of known threats. On average, organizations only had detection or visibility for 63% of the threats identified by their own threat intelligence as relevant. This leaves more than a third of known, relevant threats without operational defenses. The researchers attribute this gap to the manual and time-consuming process of translating threat intelligence into actionable detection logic and hunting hypotheses.
When measured against the MITRE ATT&CK framework, which maps adversary tactics and techniques, average protection stood at 64% for relevant techniques based on an organization's specific threat landscape and technology stack. This indicates that approximately one in three relevant techniques remains without a reliable detection mechanism.
Tom Findling, CEO of Conifers, emphasized that the industry's traditional approach of counting rules and tools is insufficient. "Deployed is not the same as protected," Findling stated. He stressed the need for security teams to understand not only which detections are working but also which threats remain uncovered and how quickly threat intelligence can be translated into effective protection.
The findings suggest a critical need for more automated and intelligent approaches to threat detection. Researchers advocate for AI solutions that can directly integrate with threat intelligence feeds, automatically generating and testing detections and hunts. Such systems would allow human analysts to focus on strategic decision-making while the AI handles the complex, iterative process of turning intelligence into operational defenses and identifying necessary telemetry fixes.