Most security operations centres are not short of tools or alerts; they are short of the coverage, context and people needed to turn those alerts into decisions. The same problems recur across in-house SOCs, managed services and hybrids: analysts buried in noise, blind spots in cloud and identity, data bills that force trade-offs, and metrics that reward closing tickets rather than catching attackers. This list covers ten challenges in our judgement of their impact on detection and response, with why each matters and what works in practice. It is for SOC managers, detection engineers and CISOs, and uses survey figures only where we have read the primary report.
The Top 10 at a glance
- Alert fatigue and false positives
- Visibility gaps in cloud, SaaS and identity
- Staff shortages, turnover and burnout
- Tool sprawl and poor integration
- Detection coverage and metrics that mislead
- Slow triage and escalation
- Missing context and asset inventory
- Automation that creates new risk
- Data cost pressure
- AI adoption without evaluation
| # | Challenge | Typical symptom | First fix |
|---|---|---|---|
| 1 | Alert fatigue | Hundreds of low-value alerts closed unread | Per-rule true positive rate; tune or retire the worst ten |
| 2 | Visibility gaps | No identity provider, SaaS or cloud audit logs | Onboard IdP and cloud control plane logs first |
| 3 | Staffing and burnout | Vacancies, single points of knowledge, night shift attrition | Runbooks, rotation, realistic coverage model or MDR |
| 4 | Tool sprawl | Analysts pivot across many consoles per alert | Consolidate views around the case, not the tool |
| 5 | Coverage and metrics | Rule counts and closure times reported as success | Tested coverage of prioritised techniques |
| 6 | Slow triage | High-severity alerts wait in a queue | Severity-based service levels and escalation criteria |
| 7 | Missing context | Analysts cannot tell who owns a host or account | Asset and identity enrichment on every alert |
| 8 | Automation risk | A playbook disables a production service account | Human approval, scope limits and rollback |
| 9 | Data cost | Logs dropped to stay inside SIEM licence | Tier data by detection value |
| 10 | Unevaluated AI | AI summaries trusted without measured accuracy | Labelled test set before go-live |
1. Alert fatigue and false positives
The challenge: default vendor rules and untuned detections produce more alerts than the team can investigate, so analysts close them on pattern rather than evidence.
Why it matters: the joint CISA and ASD guidance on SIEM and SOAR warns that "security teams may be operationally overwhelmed by false alerts from the SIEM" and may also "miss real events/incidents because of the absence of alerts". Noise and blind spots often coexist.
What works: record a disposition code on every alert and calculate the true positive rate per rule; review the ten noisiest rules monthly. The NCSC recommends "Building a feedback process into the triage capability of your SOC" and says the SOC should be "(cautiously) open to simply removing alerts that have high false positive rates". Suppress by time-bound exception, not permanent allowlist. See the Detection Engineering Guide.
2. Visibility gaps in cloud, SaaS and identity
The challenge: the SOC sees endpoints and the network well but has little from the identity provider, cloud control plane and SaaS applications. In the SANS 2025 SOC Survey, 85% of respondents said endpoint security alerts are their primary trigger for response.
Why it matters: attackers using valid cloud accounts (ATT&CK T1078.004) may never touch a monitored endpoint. In the Snowflake breach, infostealer credentials without MFA opened customer data warehouses, and in the Storm-0558 key breach only organisations with premium audit logging could see the forged-token mail access. The ASD-led priority logs guidance notes that IaaS places "a significant amount of logging responsibility on the tenant" while SaaS places it on the provider, so you must check what each provider exposes.
What works: onboard domain controller, Entra ID sign-in and Unified Audit logs (or your IdP's equivalents), cloud API audit logs and the audit logs of your most critical SaaS applications. Track service principal, API key and OAuth app activity as well as human sign-ins. See the ITDR Guide and the SaaS and OAuth App Governance Guide.
3. Staff shortages, turnover and burnout
The challenge: SOCs struggle to hire and keep analysts, especially for nights and weekends. MITRE's 11 Strategies states that "Staffing is one of the biggest challenges for a SOC" and "Staff turnover is a reality for most SOCs." The SANS 2025 survey found that "62% of SOC professionals say their organization isn't doing enough to retain top talent."
Why it matters: each departure takes undocumented knowledge with it, and the joint SIEM guidance notes that operating these platforms "can also involve long periods of highly stressful work".
What works: capture knowledge in runbooks (MITRE: "Pre-plan for departures by formally capturing institutional knowledge"), rotate analysts into detection engineering and hunting, and remove repetitive enrichment through automation. Smaller organisations that cannot staff 24x7 should use a managed service for out-of-hours monitoring and keep incident decisions in-house. See the MDR Guide and the Cybersecurity Careers Guide.
4. Tool sprawl and poor integration
The challenge: SIEM, EDR, email security, cloud security, identity and ticketing tools each have a console, and an analyst pivots through several to work one alert.
Why it matters: every pivot adds minutes and error, and overlapping tools produce duplicate alerts for the same event.
What works: MITRE's advice is to "Consolidate and harmonize views into tools and data and integrate them to maximize SOC workflow." Build around the case: alerts, enrichment and response actions should reach the analyst in one place. Before buying another product, list which detections and response actions it adds that you cannot already deliver. See the SIEM Guide.
5. Detection coverage and metrics that mislead
The challenge: SOCs report alert counts, ticket closure times and rule counts, which say little about whether an attacker would be caught. The SANS 2025 survey found "69% of SOCs still rely on manual or mostly manual processes to report metrics."
Why it matters: MITRE warns that "Choosing and monitoring the "wrong" measures can lead to wasted time or worse, a focus on harmful practices." A falling time to close can mean analysts are closing alerts without investigating.
What works: map detections to the ATT&CK techniques that matter for your threat model, test them with purple team exercises or attack simulation, and report tested coverage alongside time to contain. The NCSC notes "A common approach is to perform, red or purple team exercises of the estate you monitor". See the Breach and Attack Simulation (BAS) Guide.
6. Slow triage and escalation
The challenge: high-severity alerts wait behind low-severity ones, escalation criteria are unclear, and nobody is sure who may contain.
Why it matters: attacker dwell time grows while the alert sits in a queue, and containment waits for approval that arrives too late.
What works: set service levels by severity, define incident declaration criteria (NIST CSF 2.0 DE.AE-08: "Incidents are declared when adverse events meet the defined incident criteria"), and agree containment authority in advance (MITRE Strategy 2, "Give the SOC the Authority to Do Its Job"). Exercise the top five playbooks. See the Incident Response Guide.
7. Missing context and asset inventory
The challenge: analysts cannot quickly tell what a host does, who owns an account, whether a service account is expected to sign in from a given region, or how critical a system is.
Why it matters: without context every alert takes longer and severity is guessed. MITRE's first strategy is "Know What You Are Protecting and Why."
What works: enrich alerts automatically with asset owner, criticality, identity type (human, service account, workload, agent) and recent changes, drawing on hardware and software inventories (CSF ID.AM-01 and ID.AM-02). Give every non-human identity an owner so the SOC has someone to call. See the NHI Ownership Guide.
8. Automation that creates new risk
The challenge: SOAR playbooks are built to save time, then run containment on noisy detections, or run with broad service account rights nobody reviews.
Why it matters: the joint guidance warns that a badly configured SOAR "may significantly disrupt service delivery", and advises: "Properly implement a SIEM before you consider implementing a SOAR."
What works: automate enrichment first, then containment with human approval, scope limits and tested rollback. Treat SOAR and SIEM integration credentials as privileged non-human identities: vault, scope and rotate them. See the SOAR and Security Automation Guide.
9. Data cost pressure
The challenge: ingestion volumes grow faster than budgets, so teams drop sources or shorten retention to stay inside a licence.
Why it matters: the joint executive guidance notes "Most SIEM pricing models are based on the quantity of data the SIEM ingests." The SANS 2025 survey found "42% of SOCs dump all incoming data into a SIEM, often without a retrieval or management plan." Cost cuts made without a detection view tend to remove the identity and cloud logs that are hardest to replace.
What works: rank sources by detection and investigation value, ingest high-value sources into the SIEM first, and keep the rest in cheaper storage that can still be searched. The authoring agencies "strongly discourage using a SIEM as the central repository for all logs." See the Log Management and Retention Guide.
10. AI adoption without evaluation
The challenge: analysts use AI assistants and vendors ship AI triage, but few SOCs measure accuracy or define where AI sits in the workflow. In the SANS 2025 survey, 39.8% of respondents said AI/ML tools are used but are not part of a defined workflow, and the report states that "AI/ML tools continue to underperform."
Why it matters: an AI that closes a true positive as benign creates a silent false negative, and AI agents that act on tickets hold credentials that can be misused.
What works: build a labelled test set from past alerts, measure false negative rate before go-live, keep humans approving actions until accuracy is proven, and give each AI agent its own scoped identity. See the AI SOC Guide.
Mapping to OWASP
OWASP mapping is weak for SOC operations. The OWASP Top 10:2025 is an application security list; only A09:2025 Security Logging & Alerting Failures touches SOC work, and it focuses on application and API logs, though it does call for alerting use cases and playbooks the SOC can act on. NIST CSF 2.0 Detect and Respond subcategories and MITRE's 11 Strategies are the better map, so we use them here.
| Challenge | OWASP Top 10:2025 | NIST CSF 2.0 | MITRE 11 Strategies |
|---|---|---|---|
| 1. Alert fatigue | A09 (weak fit) | DE.AE-02, ID.IM-03 | 8 Leverage Tools to Support Analyst Workflow |
| 2. Visibility gaps | A09 (application logs only) | PR.PS-04, DE.CM-03, DE.CM-06, DE.CM-09 | 7 Select and Collect the Right Data |
| 3. Staffing and burnout | Not mapped | GV.RR-03 | 4 Hire AND Grow Quality Staff |
| 4. Tool sprawl | Not mapped | DE.AE-03 | 8 |
| 5. Coverage and metrics | Not mapped | ID.IM-01, ID.IM-02 | 10 Measure Performance to Improve Performance |
| 6. Slow triage | A09 (missing playbooks) | DE.AE-08, RS.MA-02, RS.MA-03, RS.MA-04 | 2, 5 Prioritize Incident Response |
| 7. Missing context | Not mapped | ID.AM-01, ID.AM-02, DE.AE-04 | 1 Know What You Are Protecting and Why |
| 8. Automation risk | Not mapped | RS.MI-01, DE.AE-06 | 8 |
| 9. Data cost | Not mapped | PR.PS-04 | 7 |
| 10. Unevaluated AI | Not mapped | ID.IM-01, DE.AE-02 | 8, 10 |
Where to start
If you can do only three things this quarter, tackle the challenges that make the others worse:
- Measure true positive rate per rule and tune or retire the ten noisiest rules (challenge 1). This frees analyst time for everything else.
- Onboard identity provider, cloud control plane and critical SaaS audit logs, with alerts when a feed stops (challenge 2).
- Replace activity metrics with tested coverage and time to contain (challenge 5), produced from tooling rather than spreadsheets.
Track five numbers monthly: true positive rate for the bottom ten rules, priority log sources reporting on time (target 100%), median time to contain high-severity incidents, prioritised ATT&CK techniques with a passing test, and analyst attrition. Then baseline the whole operation with the SOC Guide.
Primary sources: NIST CSF 2.0, MITRE 11 Strategies of a World-Class Cybersecurity Operations Center, CISA and ASD Guidance for SIEM and SOAR Implementation and Priority Logs for SIEM Ingestion, NCSC Detection practices, the SANS 2025 SOC Survey (sponsor-hosted copy), OWASP A09:2025 and MITRE ATT&CK T1078.004.
Related NHI Mgmt Group resources: SOC Guide · SIEM Guide · Threat Intelligence Guide · Incident Response Guide