Intezer Report Finds Threats in Low-Severity SOC Alerts and EDR ‘Mitigations’

Article Details

Publisher

Cybersecurity Pulse; Intezer published the report being analyzed

Report Period

2025 operational data, analyzed in Intezer’s 2026 report

Scope

Operational security alerts and investigations across production enterprise SOC environments

Sample Size

25 million alerts; 10 million monitored endpoints and identities; 180 million files; 7 million IP addresses; 550,000 phishing emails; more than 82,000 endpoint forensic investigations

Key Statistics

• Intezer reported that nearly 1% of low-severity and informational alerts were real threats; the article estimates this could represent roughly 54 missed incidents per enterprise per year at the stated alert volume.
• In 1.6% of more than 82,000 endpoint forensic scans, Intezer found active compromises despite the EDR reporting the threat as mitigated.
• Intezer reported that 2% of low-severity endpoint alerts were confirmed incidents.
• Less than 8% of 550,000 user-reported phishing emails were confirmed malicious; fewer than 6% of the malicious emails carried an attachment, while around 30% relied on a link.
• S3 accounted for roughly 70% of AWS control violations in the report.

Recommendations

• Use AI-augmented forensic triage to investigate alerts that cannot be covered manually.
• Verify endpoint status rather than relying blindly on an EDR’s “mitigated” verdict.
• Reassess phishing defenses for browser-based, link-driven attacks and credential-harvesting pages.
• Audit cloud posture, including S3 ACL use and permissive cross-account policies.
• Build team fluency with AI and evaluate AI SOC platforms for alert triage.