Ask a security leader whether their team has enough alerts and you'll probably get a tired laugh. Most have more than they can work through and still can't say which of today's thousand notifications matters.
That's the real problem with the modern security operations centre (SOC). Detecting things isn't hard anymore. Knowing which detections deserve a human's attention is, and the pressure is rising as attackers speed up. Yet most SOCs still judge their own success by counting incidents.
Busy isn't the same as safe
Endpoints, networks, cloud workloads and identity systems each raise their own alerts, in their own consoles. Together, they rarely tell a story.
A failed login from an odd location looks like nothing. The same login, followed by a privilege change and a large file transfer, looks like an attack. But an analyst only sees that if someone joins the dots and under time pressure. And when harmless activity trips the same rule every week, people stop looking closely.
The 2026 SANS SOC Survey drew 444 qualified responses. Respondents named endpoint alerts (86%) and automated SIEM alerts (78%) among the things that most often trigger a response, while evidence from proactive hunting came in at 63% (Crowley, 2026). Most SOCs, in other words, depend on the quality of the flag.
The cost of too many tools
Few organisations chose their stack in one go. It grew over years, one reasonable purchase at a time, and the result is often good products that barely talk to each other, with evidence scattered across consoles while the attacker keeps moving.
At leadership level, among the 69 CISOs and senior executives surveyed separately, 24% named a lack of enterprise-wide visibility as the single biggest barrier to getting value from their SOC, ahead of automation gaps (16%) and skilled-staff shortages (14%). Spending isn't the cure either: the report found that deliberate data strategy predicts satisfaction with technology more reliably than budget does (Crowley, 2026).
We're not suggesting anyone rip out what they have. Start by asking how well your tools share information, and whether your response is one process or a relay between teams.
Rank by risk, not by volume
A detection system is good if the right alerts reach the right person quickly, not because it produces many. Rank by severity, asset importance, data sensitivity and likelihood of further compromise, and use a SIEM and detection and response tooling to correlate signals across endpoints, identity and cloud.
People matter here too. Respondents said meaningful work (26%) and career progression (24%) keep analysts, with money fourth (Crowley, 2026). A shift spent closing duplicates is hardly meaningful work.
Where automation and AI fit
Automation can enrich alerts, group related events and run routine response steps. Done badly, it makes mistakes faster: a poorly built playbook will isolate the wrong server at 2am very efficiently.
Some 79% of respondents use AI or machine learning tools, but only 36% have built them into a defined workflow, and most use them without governance or consistent validation. The report warns of polished, confident output that nobody can challenge (Crowley, 2026). So decide what runs unattended, what needs approval and how you'll check results.
Threats at machine speed
Attackers are using AI too. It helps them automate reconnaissance, write convincing phishing and move from first access to damage faster than a manual process can follow. The survey's foreword puts it neatly: adversaries adapt in hours, while the SOC adapts in years (Crowley, 2026). Automate the routine work machines do better, keep people for the judgment calls.
From alerts to exposure
Better triage is only half the answer. The other half is reducing what's worth alerting on. That's the thinking behind continuous threat exposure management (CTEM): continually finding exposures across the environment, ranking them by business impact and reachability, testing which are exploitable, and getting them fixed. Rather than waiting for an alert, you close the most likely route in first.
The survey found that 74% of leaders apply threat intelligence to operations and hunting, but only 26% use it to inform spending (Crowley, 2026). CTEM ties the two together.
Measure what matters
Cyberrey's view: The incident count should stop being an SOC's headline number. It has topped the survey's list of reported metrics for 10 years running, cited by 70% of respondents and used most often to set budgets (Crowley, 2026). Yet it only measures how busy the SOC is. A rising count could mean a better SOC or a worse threat environment, and the number can't say which. Worse, it rewards the wrong behaviour: more alerts, more tickets, more apparent work. Report time from detection to containment, how thoroughly incidents were eradicated and how avoidable they were instead (Crowley, 2026). Those are numbers a board can act on.
Fewer alerts, better decisions
Organisations don't need their tools to shout louder. They need them to connect, prioritise sensibly and support a response that matches the threats they face. An SOC should tell you what matters and what to do next. That comes from better decisions made at the right time, and more alerts won’t get you there.
Reference:
Crowley, C. (2026) 2026 SANS SOC Survey Insights: A Decade of Evolution in Cyber Defense. SANS Research Program, SANS Institute, June. Available at: [add link to report]
Share
