Topic starter
02/08/2026 11:55 am
TL;DR: The 2021 SANS Security Operations Center Survey results highlight how SOC teams are prioritising threat response, log analytics, and false-positive reduction, according to Anomali. The real issue is not visibility alone, but whether detection and response workflows can be operationalised fast enough to reduce analyst overload and improve control execution.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “2021 SANS Security Operations Center Survey Results”.
Key questions
Q: How should SOC teams operationalize threat intelligence so it actually changes response speed?
A: Security teams should connect threat intelligence to an orchestration layer that can enrich indicators, validate inputs, and trigger playbooks automatically.
Q: Why do false positives create such a large SOC risk?
A: False positives erode trust in the alert pipeline, which leads analysts to discount both bad and good signals.
Q: What breaks when IOCs are not operationalised?
A: When IOCs are not operationalised, they become static references instead of live control inputs.
Practitioner guidance
- Map detections to specific containment actions For the highest-priority use cases, define exactly which action follows which alert, such as case creation, account lockout, indicator block, or host isolation.
- Tune out low-value alerts systematically Review suppression logic, enrichment quality, and escalation thresholds together so false-positive reduction improves throughput without hiding meaningful attack behaviour.
- Measure response latency from indicator to action Track the time between validated intelligence and the completion of the control action, then use that measure to identify where approvals, handoffs, or manual steps are slowing containment.
Bottom line: The core problem is not a lack of telemetry, but the gap between detection insight and repeatable operational response.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Operational response is the real control plane: the value of threat intelligence depends on whether it changes what the SOC actually does. Many programmes still over-invest in collection and under-invest in response orchestration, so the practical gap is not awareness but execution. That makes analyst workflow design a control issue, not a reporting issue.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should response teams connect IAM controls to SOC workflows?
A: Response teams should predefine identity actions such as privilege reduction, session termination, token revocation, and service account quarantine inside incident playbooks. That matters because many attack paths rely on identity abuse, and containment is often faster when the SOC can act on access rather than only on malware or infrastructure alerts.
👉 Read our full editorial: SANS SOC survey results frame the gap in operational response