We’ve been digging into the latest threat intelligence, and what we found stopped us in our tracks. Security teams are collecting more data than ever, yet they’re missing the attacks that actually matter.
A new wave of research released over the past two months paints a troubling picture: organizations are drowning in alerts, buried in false positives, and unknowingly blind to the techniques attackers use most. Let’s walk through what we uncovered.
Three Surprising Findings
The Logging Mirage
We discovered that just because an attack is logged doesn’t mean your team will ever know about it. Take pass-the-ticket attacks, one of the most common lateral movement techniques. They’re logged only 42% of the time, and even when they are, they trigger an alert just 16% of the time. That means security teams have the data, but their tools fail to flag it as malicious.
The 99.53% Noise Problem
Here’s a number that shocked us: only 0.47% of all vulnerability scanner findings are actually exploitable in real-world environments. Out of tens of thousands of alerts, less than half of one percent represent genuine risk. Teams are burning hours, sometimes days, chasing ghosts while real threats slip through.
The Security Debt Crisis
Perhaps most alarming: 60% of the most severe, exploitable flaws have remained unresolved for more than a year. We’re not talking about low-priority issues. These are critical vulnerabilities that attackers could, and eventually will, use. Yet they sit unpatched, buried under backlogs of lower-risk findings.
Key Findings
We pulled data from five independent sources released in early 2026. Here’s what the numbers tell us:
- Pass-the-ticket attacks are logged 42% of the time but trigger alerts only 16% of the time (Security Risk Advisors, The Purple Perspective 2026, March 6, 2026)
- Scheduled task persistence is logged 66% of the time but alerted on just 27% (Security Risk Advisors, The Purple Perspective 2026, March 6, 2026)
- HTTPS command & control over port 443, a technique designed to blend with legitimate traffic, is logged only 47% of the time and triggers an alert a mere 10% of the time (Security Risk Advisors, The Purple Perspective 2026, March 6, 2026)
- Only 0.47% of all vulnerability scanner findings are actually exploitable in real-world environments (Hadrian, 2026 Offensive Security Benchmark Report, February 9, 2026)
- 95% of security leaders say they’re dissatisfied with their ability to prioritize remediation based on real-world risk (Hadrian, 2026 Offensive Security Benchmark Report, February 9, 2026)
- 82% of organizations now carry “security debt”, vulnerabilities that remain unremediated over time (Veracode, 2026 State of Software Security Report, February 26, 2026)
- 60% of the most severe, exploitable flaws have remained unresolved for more than a year (Veracode, 2026 State of Software Security Report, February 26, 2026)
- Traditional SIEMs detect only about 21% of MITRE ATT&CK techniques on average (Mitiga Security, January 15, 2026)
- Organizations face an average of 2,090 cyber attacks per week globally, a 17% increase year-over-year (Check Point Research, Cyber Security Report 2026, January 2026)
- Cyber incidents now rank as the #1 global business risk for the fifth consecutive year, with 42% of Allianz Risk Barometer respondents citing it as their top concern (Allianz, Risk Barometer 2026, January 2026)
What This Means for Security Teams
If you’re a SOC analyst, threat hunter, or CISO, these numbers probably feel uncomfortably familiar. Your team is collecting telemetry, running scans, and responding to alerts. But the data suggests you’re operating with one hand tied behind your back.
The gap between “logged” and “alerted” isn’t a technical failure, it’s a design flaw in how we’ve built security operations. We’re optimizing for data collection when we should be optimizing for context and prioritization.
When 95% of security leaders can’t prioritize risk effectively, and only 0.47% of scanner findings actually matter, the problem isn’t insufficient tools. It’s insufficient intelligence.
Expert Quote
“These findings confirm what we’ve been hearing from security teams for years: they’re drowning in data but starving for context. Collecting logs isn’t the same as detecting threats. At Network Threat Detection, we focus on closing that gap, modeling attack paths and prioritizing risks based on actual exploitability and business impact. Because when a pass-the-ticket attack gets logged 42% of the time but alerted only 16%, the real question isn’t ‘what more can we log?’ It’s ‘how do we make every relevant event actionable?’”
– Founder, Network Threat Detection
Methodology
Our analysis draws from five independent research sources released between January and March 2026, including data from Security Risk Advisors’ The Purple Perspective 2026 (based on over 160 real-world purple team exercises), Hadrian’s 2026 Offensive Security Benchmark Report (drawing from 300+ organizations), Veracode’s 2026 State of Software Security Report (analyzing 1.6 million applications), Check Point Research’s Cyber Security Report 2026, and the Allianz Risk Barometer 2026.
Ready to see how we close the gap between logging and detection? Read the complete analysis with full methodology on our blog.
Read the full analysis → Fixing the 90% Blind Spot: A Deeper Look at the Detection Gap
Explore our threat modeling platform → Network Threat Detection Platform
