The demand for more accurate and reliable threat detection, investigation and response solutions has never been greater. As organizations grow and their environments expand to a mixture of on-premises and cloud, the day-to-day of a security operation center (SOC) professional becomes more complex. However, despite organizations investing heavily in tools designed to detect and mitigate threats, SOC teams are limited by the tools’ lack of accurate threat signal to help them identify and stop real attacks. Teams increasingly feel like they can’t keep pace with attacks while threats remain buried in a flood of noise and pointless alerts. This fragmented approach to security that burdens teams with inefficiency is challenging SOC teams’ confidence and competence staying ahead of the evolving threat landscape.
Also Read: CIO Influence Interview with Kevin Bocek, Chief Innovation Officer at Venafi
It is clear that legacy threat detection and response approaches can’t keep pace with the evolving hybrid and multi-cloud attack landscape, and SOC teams are feeling the impact. Here are three areas where legacy threat detection and response tools are falling short, and how we as an industry must address moving forward.
Tool overload and the operational costs of maintenance
SOC teams today quite simply have far too many detection tools that they are relying on to detect, prioritize and stop attacks. Research shows that 73% of SOC practitioners are using more than 10 tools, while 45% manage more than 20. While not entirely surprising considering the ever-expanding hybrid and multi-cloud attack surface, this has led to tool sprawl, where a lack of consolidation leaves many SOCs vulnerable and stretched thin managing too many tools and alerts, making streamlining SOC workflows nearly impossible.
The problem isn’t just the number of tools; it’s also the effort required to maintain them. Over three-fourths (77%) of SOC teams report that they are setting aside critical security tasks multiple times a week to tune, monitor, and maintain their security tools, with some teams facing this burden daily. This constant maintenance requirement means it’s much more likely crucial alerts will be missed. This has manifested into feelings that tools are being bought simply to check off compliance boxes, rather than meaningfully improving their ability to detect, prioritize and stop real attacks.
Too much alert noise, not enough signal clarity
While research indicates that the number of alerts has decreased ever so slightly from last year, it remains too high for teams to efficiently and effectively manage each day. Buried within the flood of notifications teams receive are real threats that can easily be missed and ultimately go unaddressed simply due to the lack of time and right tools to help triage, correlate and prioritize them. Alarmingly, SOC practitioners report that they can only realistically handle about 38% of the alerts they receive, while they estimate only 16% of these could represent actual attacks.
The core issue is that the alert fidelity from many of these tools isn’t improving. Despite generating thousands of alerts daily, the question remains: are tools effectively delivering an accurate attack signal? Many SOC practitioners feel the answer is no. Vendors are selling threat detection solutions that produce so much noise SOC teams struggle distinguishing what is a real threat and what is not.
Growing distrust as SOC teams lose faith in vendors
When we consider that security teams have too many tools in their arsenal, all of which are generating alerts at an unmanageable level, it’s not surprising that dissatisfaction and distrust is growing amongst practitioners towards the tools they use and vendors that provide them. The number of alerts being generated by legacy threat detection and response tools puts security professionals in a difficult position. On one hand, they don’t have the time or resources to address every alert, but if a malicious true positive is missed, they can’t claim ignorance because vendors can claim their tools technically detected and alerted them. This is at the core of SOC teams’ frustration with both the tools and vendors. Nearly half (47%) of practitioners report they do not trust their tools to function as needed, and 54% say these tools actually increase their workload instead of reducing it.
The constant flood of alert noise and false positives is a major source of disillusionment for security teams. Practitioners feel that vendors are pushing tools that generate excessive, pointless alerts to avoid responsibility in case of a breach, rather than helping SOCs address real attacks effectively. This approach erodes any sense of partnership that SOC teams once felt with their vendors, as many are disheartened with the lack of meaningful collaboration.
Also Read: CIO Influence Interview with Mark Whitehead, CEO and co-founder, NDay Security
The role of AI in enhancing threat detection and reducing alert fatigue As SOC teams face increasing frustration with legacy threat detection and response tools and growing skepticism toward vendors, it’s clear that the industry needs to shift its approach. With 57% of SOC practitioners tired of empty promises and tools that require constant tuning, there’s an urgent need for vendors to bridge this gap by delivering more effective tools that can provide accurate integrated attack signal. Security professionals are open to adopting tools that address the real demands of the SOC, and vendors have an opportunity to rebuild trust by proving the efficacy and efficiency of their signal.
One promising path forward is through the innovation and adoption of AI-driven attack signal intelligence. SOC teams recognize the value of AI to not only reduce meantime to detect and respond, but reduce the manual operational burden that comes with identifying new threats, creating and tuning detection rules, analyzing, detecting and triaging events, and attributing, correlating and prioritizing an endless sea of alerts. With growing trust in AI’s capabilities to deliver accurate, integrated attack signal intelligence, many practitioners are optimistic about its potential to replace legacy tools and reduce exposure, remove latency and maximize SOC time and talent.
The current threat detection and response approach is outdated and broken but it’s not beyond repair. There are opportunities for vendors to work more closely with security teams to deliver AI-driven solutions that build SOC confidence and competence. Early sentiment around AI proves promising but vendors must work to establish trust. To do this, vendors must deliver tools that enhance SOC teams’ efficiency and efficacy. Detecting potential threats is easy, SOC teams get thousands of them every day, but delivering accurate integrated attack signal – that’s the real challenge vendors need to be held accountable for and prove. Challenge accepted.
