One Missed Threat Per Week: What 25M Alerts Reveal About Low-Severity Risk

A 2026 report analyzing 25 million security alerts reveals that defenders systematically ignore low-severity alerts, missing approximately one confirmed breach per week at enterprise scale.

• •1% of confirmed incidents originated from low-severity alerts, meaning ~54 real threats annually per organization go uninvestigated
• •51% of endpoint compromises marked 'mitigated' by EDR were still infected, showing EDR verdicts are unreliable
• •Phishing now uses legitimate platforms (Vercel, CodePen, OneDrive, PayPal) instead of attachments, with four new gateway-bypass techniques at scale
• •S3 misconfigurations comprise 70% of cloud violations and are systematically exploited post-compromise
• •AI SOC platforms investigate all alerts with 98% accuracy and sub-minute triage, enabling continuous improvement