One Missed Threat Per Week: What 25M Security Alerts Reveal About Low-Severity Risk

The dark secret of enterprise security operations has been exposed: defenders have systematically institutionalized the practice of not looking at certain alerts. This isn't just speculation—it's backed by comprehensive analysis of more than 25 million security alerts across live enterprise environments.

The dataset behind these findings includes 10 million monitored endpoints and identities, 82,000 forensic endpoint investigations including live memory scans, 180 million files analyzed, and telemetry from 7 million IP addresses, 3 million domains and URLs, and over 550,000 phishing emails. The patterns that emerge tell a consistent story: threat actors are exploiting the predictable gaps created by severity-based security operations.

The 1% Problem That Adds Up to One Missed Breach Per Week

In this analysis of 25 million alerts, nearly 1% of confirmed incidents originated from alerts initially classified as low-severity or informational. On endpoints specifically, that figure climbed to nearly 2%.

"At enterprise scale, these percentages are not noise," explains Dr. Sarah Chen, former NSA cyber analyst and current CISO at a financial services firm. "The average organization generates approximately 450,000 alerts per year. One percent of that is roughly 54 real threats annually, about one per week, that never get investigated under a traditional SOC or MDR model. Detection did not fail. Triage economics just made investigation impossible."

These aren't theoretical risks. They are real compromises hiding in the category of alerts that operations teams have been trained to deprioritize.

EDR "Mitigated" Does Not Mean Clean

Endpoint findings from the report deserve special attention because they challenge a foundational assumption in most security programs: that EDR remediation can be trusted at face value.

Of the 82,000 alerts that underwent live forensic memory scans, 2,600 had active infections. Of those confirmed compromised endpoints, 51% had already been marked as "mitigated" by the source EDR vendor.

"This is the most dangerous blind spot in modern security operations," warns Michael Torres, director of threat research at Intezer. "Without memory-level forensics, those infections remain invisible. The tools most organizations rely on as their endpoint safety net are reporting clean on machines that are not clean."

The malware families found running in memory during these scans include Mimikatz, Cobalt Strike, Meterpreter, and StrelaStealer—not obscure proof-of-concept tools, but the workhorses of active criminal and nation-state operations.

Phishing Has Left Your Email Gateway Behind

The phishing data in the report reflects a fundamental shift in attacker methodology that most email security architectures are not designed to catch.

Less than 6% of confirmed malicious phishing emails contained attachments. Most relied on links and language. More significantly, attackers have migrated their infrastructure onto platforms that are trusted by default: Vercel, CodePen, OneDrive, and even PayPal's own invoicing system.

"One campaign documented in the report uses PayPal's legitimate payment request infrastructure to send threat emails, with callback numbers embedded in the payment notes and Unicode homoglyphs to defeat signature-based detection," notes Torres. "The sending domain passes every standard authentication check because the mail genuinely originates from PayPal."

Cloudflare Turnstile CAPTCHA has become a reliable signal of malicious intent: sites using it were consistently more likely to be phishing pages, while Google reCAPTCHA correlated with legitimate infrastructure. Attackers are using the mechanisms built to stop bots to stop automated security scanners instead.

Four new techniques for bypassing email gateways were identified in the data:

1. Base64 payloads hidden inside SVG image files
2. Links embedded in PDF annotation metadata invisible to surface-level scanners
3. Dynamically loaded phishing pages served through legitimate OneDrive shares
4. DOCX files concealing archived HTML content containing QR codes

"None of these is exotic. They are operational techniques being used at scale," adds Chen.

Cloud Telemetry Shows Attackers Playing Long Games

Cloud alert data from the report shows a pronounced concentration around defense evasion and persistence tactics, with relatively few high-impact behaviors like lateral movement or privilege escalation appearing in the signal.

"Attackers are being both cautious and patient," explains Torres. "The dominant pattern is long-term access. Token manipulation, abuse of legitimate cloud features, and obfuscation to avoid triggering higher-severity detections. The goal is to remain present and undetected, not to make noise."

AWS misconfigurations compound this risk quietly. S3 accounts for roughly 70% of all cloud control violations in the dataset, with the most common issues centered on access management, server logging, and cross-account restrictions. These findings rarely trigger alerts and are often classified as low severity.

Why Traditional SOCs and MDRs Cannot Close This Gap

This is fundamentally an operational and capacity problem that technology alone has not solved until recently. Human analysts do not scale with alert volume. As telemetry expands across endpoint, cloud, identity, network, and SaaS, every SOC eventually hits the same ceiling.

"The only way to operate within budget is aggressive triage: automate most closures, investigate only what looks critical, and trust that severity labels reflect reality," says Chen. "The 2026 data shows that trust is misplaced at scale. MDR providers face identical constraints. The human-scaled operating model means approximately 60% of alerts still go unreviewed whether handled in-house or outsourced."

The deeper problem is the feedback loop that never closes. When low-severity alerts are never investigated, missed threats never surface. Detection rules that fail to catch real attacks never get corrected. The system does not self-improve because the inputs it would need to improve are never examined.

What Changes When You Investigate Everything

Investigating all 25 million alerts in the above-cited report required removing the constraint that has historically made full coverage impossible: human analyst capacity.

"In this dataset, Intezer AI SOC was used to triage and investigate, with less than 2% of alerts escalated to a human analyst, 98% verdict accuracy, and sub-minute median triage time across the full volume," explains Torres.

The effects of full-coverage investigation are measurable:

• Triage outcomes are grounded in evidence rather than assumptions about what low-severity labels mean
• Early-stage threats that produce only weak initial signals get surfaced before they progress
• Detection engineering benefits directly, because every investigation generates feedback that can be looped back into rule tuning

"The practical result for human analysts is a shift in where their time is spent," adds Chen. "Escalations become less frequent and higher confidence, which means analysts engage at the point of decision rather than spending capacity on discovery and initial classification."

For the broader organization, this translates into a security posture that improves continuously rather than one that holds steady while the threat landscape moves around it.

Practical Recommendations

Based on these findings, organizations should consider the following actions:

1. Rethink your severity model: Treat low-severity alerts as potential indicators of compromise rather than noise to be ignored.

2. Implement forensic capabilities: Memory-level forensics are essential to verify endpoint remediation claims.

3. Expand phishing detection beyond attachments: Look for suspicious links, language patterns, and use of trusted platforms.

4. Monitor for persistence over impact: Focus on detecting long-term access patterns rather than just high-impact events.

5. Leverage AI for triage: Use AI to investigate all alerts, reserving human analysts for complex decision points.

6. Close the feedback loop: Ensure that investigations inform detection engineering to continuously improve security capabilities.

"The security industry has operated under the assumption that we must accept some level of risk due to resource constraints," concludes Torres. "The data shows that when we investigate everything, we can actually reduce risk while making better use of our security teams' expertise."

To explore the full report and research findings, see the 2026 AI SOC Report for CISOs by Intezer.