Is AI entering the SOC at the right stage?
Brief
By Simon Phillips, CTO, CybaVerse
Alert fatigue is an issue that has plagued Security Operations Centres for years.
As organisations’ digital estates grow, there is more architecture to secure and more architecture for threat actors to attack, which has ultimately led to more alerts.
Today, on average a SOC will face thousands of alerts every day, each of which could indicate a potential threat. Each alert must therefore be analysed and investigated before appropriate action can be taken.
However, ask any SOC analyst and they will tell you the majority of these alerts are benign or false positives.
Yet, analysts will still spend hours investigating activity that ultimately poses little or no risk, hoping to identify the small number of genuine threats hidden amongst the noise.