Conifers research finds 37% of known relevant threats lack detection coverage

Conifers, developer of the CognitiveSOC agentic AI SOC platform, has published The Detection Blind Spot, a report analysing 14,652 detections across live enterprise environments. The study found organisations had working detections, hunts or compensating visibility for only 63% of the threats they had identified as relevant, leaving more than a third of known threats without operational coverage.

Coverage extended to just 64% of the MITRE ATT&CK techniques relevant to each environment, and 47% of deployed detections required attention before they could be trusted to work as intended. Those detections could still appear healthy in traditional inventory-based reporting. The problems fell into five categories: logic errors, missing telemetry, queries aimed at the wrong data tables, duplicates that raised alert volume without adding coverage, and noisy detections analysts learned to ignore.

Conifers said the gap extends beyond the SIEM, since endpoint, cloud, identity, email and network products each generate vendor-authored detections that security teams often cannot edit. The report recommends measuring coverage through verified working detections, managing detection health across vendor-managed tools, and tracking how quickly intelligence becomes protection.