Rethinking MDR as Attackers and Defenders Embrace AI
The article argues MDR is struggling to keep up with AI-driven attacks and alert overload. It says modern security teams need more transparency, feedback loops, and automation than most MDR services provide.
Intelligence analysis by GPT-5.4 Mini
Managed detection and response was built for an era of staff shortages and alert fatigue, but the article says AI has changed both sides of the fight. Attackers can move faster and blend into noisy environments, while MDR still depends on humans triaging alerts in a queue.
The article says MDR is like hiring a night watch team for a giant building, but the building now has way more doors and the burglars are using better tools. If the watch team only checks the loud alarms, some quiet break-ins can still slip through.
Analysis
What the article argues
Managed detection and response filled a real gap for teams that could not staff a 24/7 security operation. The article says that model worked when the main problem was alert volume and analyst shortage, but that the threat landscape has now moved faster than the service model.
Attackers, it says, are using AI to generate more convincing phishing, speed up reconnaissance, and create malware variants that are harder to catch with signature-based detection. At the same time, enterprise attack surfaces now span endpoint, cloud, identity, and network, which makes alert streams larger and harder to review manually.
Where MDR falls short
The article’s central complaint is that MDR still depends on human triage of alerts in order of severity. That means many alerts never get reviewed. It cites an industry estimate that about 60% of alerts go unreviewed, and says a separate analysis of 25 million alerts found that nearly 1% of real threats came from low-severity or informational alerts. In the article’s example, that would mean roughly 54 incidents a year in an environment producing 450,000 alerts annually.
It also argues that investigation quality varies based on who is on shift, how deep the queue is, and whether the team is fully staffed. A serious alert at 3 a.m. may get a different result than the same alert during the day. The author frames that variance as unavoidable in any human-heavy process running at high volume.
Transparency and lock-in
The article says MDR often behaves like a black box: customers get summaries and escalations, but not the full investigation trail or the reasoning behind a closure. That makes it hard to audit missed incidents, explain decisions to regulators, or improve defenses from the evidence.
It also says AI savings mostly stay with the vendor. Providers can automate parts of triage and lower their own costs, but customers do not necessarily get cheaper contracts or broader coverage. Finally, it argues that detection rules, case history, and tuning knowledge stay inside the vendor platform, so customers lose that institutional knowledge if they switch providers or bring operations in-house.
The article’s overall conclusion is blunt: organizations may have outgrown classic MDR if they need better visibility, faster learning, and more ownership of their detection work.
Key points
- The article says MDR was built for analyst shortages, but AI has changed the threat environment faster than the model can adapt.
- It argues that 24/7 human coverage is not the same as 24/7 full alert review, and many alerts remain unreviewed.
- The piece claims real threats can hide in low-severity and informational alerts that get deprioritized.
- It says MDR quality varies by shift, staffing, and analyst experience, which creates inconsistent investigations.
- The article criticizes MDR black-box workflows, vendor lock-in, and the fact that AI savings may stay with providers.
If security teams use the article’s critique as a trigger to rethink MDR, they may push for better visibility, stronger feedback loops, and more coverage of low-severity alerts. That could help them catch early attacker activity before it turns into a bigger incident. The piece also suggests AI could help defenders scale if the gains are applied to customers, not just vendors.
If the article’s concerns are accurate, many organizations may be paying for 24/7 coverage that still leaves large parts of the alert queue effectively unattended. That creates a risk that quiet intrusions, lateral movement, or noisy but important weak signals remain buried until damage is done. The black-box nature of many MDR services also makes it harder to know whether gaps are improving or getting worse.
