Rethinking MDR as Attackers and Defenders Embrace AI

This article critiques the limitations of Managed Detection and Response (MDR)—noting that roughly 60% of alerts go unreviewed, investigation quality varies by analyst and shift, and vendor lock-in prevents customer ownership of detection knowledge—and promotes an AI SOC model that automatically investigates every alert with forensic depth, provides closed-loop detection engineering, and aligns pricing and ownership to ensure full coverage in the AI-era threat landscape.