Alert Fatigue

Your SOC generates thousands of alerts a week. Almost none of them are real. Your analysts know this - and they still have to look at every single one, because the day they don't is the day the real one gets through. That fear has a name in the field: FOMI, the fear of missing incidents. It is not a discipline problem, and it will not be fixed by a resilience workshop, a stricter SLA, or hiring on...