Nine years of SigmaHQ show detection exclusions added 5.4x more often than withdrawn.

Measuring 8,234 revisions over nine years, with suppression detected semantically and validated against blinded hand labelling at 0.828 precision and 0.911 recall, exclusions were added 1,642 times and withdrawn 304 (arXiv 2608.31062). Per individual rule the ratio climbs to 13-to-1, and 86.7% are still in force three years later regardless of whether the rule is sole coverage for its ATT&CK technique. 31% of the narrowing is invisible to structural diff, and 64.1% of path-valued exclusions can be satisfied by an unprivileged process choosing a filename. Your detection coverage is quietly smaller than your rule count suggests.