Study: Widespread Alert Fatigue Results in Ignored Cybersecurity Alerts
Cybersecurity analysts are being overwhelmed by a flood of false positive alerts from disparate solutions, with missing incidents a rising fear.
MILPITAS, Calif. — Cybersecurity firm FireEye (NASDAQ: FEYE) announces the release of the IDC InfoBrief, “The Voice of the Analysts: Improving Security Operations Center Processes Through Adapted Technologies.”
In surveying hundreds of internal and managed security service provider (MSSP) security analysts and managers, the report finds that security analysts are becoming less productive due to widespread “alert fatigue” resulting in ignored alerts, increased stress and fear of missing incidents.
To improve job satisfaction and effectiveness, the report also uncovered the top activities analysts felt would be best to automate to better secure their security operations centers (SOCs).
“Security analysts are being overwhelmed by a flood of false positive alerts from disparate solutions while growing increasingly concerned they may miss a true threat,” says Chris Triolo, vice president of customer success at FireEye. “To solve these challenges, analysts are asking for advanced automation tools, like Extended Detection and Response, which can help reduce the fear of missing incidents while strengthening their SOC’s cybersecurity posture.”
Security analysts continue to feel the pressure of increased alerts, spending almost half their time on false positives. According to the report:
- While analysts and IT security managers receive thousands of alerts every day, respondents indicated 45% of the alerts are false positives, making in-house analysts’ jobs less efficient and slowing workflow processes. To manage alert overload in the SOC, 35% of this group said that they ignore alerts.
- MSSPs spend even more time sifting through false positives, and they ignore more alerts. MSSP analysts indicated that 53% of the alerts they receive are false positives. Meanwhile, 44% of analysts at managed service providers said they ignore alerts when their queue gets too full, which could lead to a breach involving multiple clients.
Fear of missing incidents (FOMI) is impacting a majority of security analysts and managers. According to the report:
- As analysts experience more challenges managing alerts manually, their worry of missing an incident also increases: Three in four analysts are worried about missing incidents, and one in four worry “a lot” about missing incidents.
- Yet, this FOMI is plaguing security managers even more than their analysts: More than 6% of security managers reported losing sleep due to fear of missing incidents.
Analysts need automated SOC solutions to combat FOMI, the report states:
- Less than half of enterprise security teams are currently using tools to automate SOC activities: Respondents shared the top tools they use to investigate alerts, showing that less than half use artificial intelligence and machine learning technologies (43%), Security Orchestration Automation and Response (SOAR) tools (46%), Security Information and Event Management (SIEM) software (45%), Threat Hunting (45%), and other security functions. In addition, only two in five analysts use artificial intelligence and machine learning technologies alongside other tools.
- To manage their SOCs, security teams need advanced automated solutions to reduce alert fatigue and improve success by focusing on more high-skilled tasks like threat hunting and cyber investigations: When ranking the activities that are best to automate, threat detection was the highest (18%) on the analysts’ wish list, followed threat intelligence (13%) and incident triage (9%).
IDC surveyed 300 IT security managers and security analysts in the U.S. working in SOCs across multiple verticals including financial, healthcare and government, as well as 50 managed security service providers. Conducted in Fall 2020, the survey participants were queried on the challenges they experience managing their SOCs.
Additional report analysis is available here.
This article originally appeared in CS sister publication Security Sales & Integration.
If you appreciated this article and want to receive more valuable industry content like this, click here to sign up for our FREE digital newsletters!
Related Content
Leading in Turbulent Times: Effective Campus Public Safety Leadership for the 21st Century
This new webcast will discuss how campus public safety leaders can effectively incorporate Clery Act, Title IX, customer service, “helicopter” parents, emergency notification, town-gown relationships, brand management, Greek Life, student recruitment, faculty, and more into their roles and develop the necessary skills to successfully lead their departments. Register today to attend this free webcast!
