Notifications
Clear all
Topic starter
08/07/2026 7:02 pm
TL;DR: Cybersecurity Insiders' 2025 Pulse of the AI SOC found that 76% of respondents say alert fatigue is their most pressing SOC challenge, while 88% report rising alert volumes and 46% saw growth above 25%, underscoring why visibility and prioritization now matter more than raw event intake. Traditional SIEM tuning is no longer enough when identity, behaviour, and risk context drive the difference between noise and action.
NHIMG editorial — based on content published by Gurucul: Smart SIEM for the Smarter SOC: Better Visibility, Detections and Risk Prioritization
By the numbers:
- 76% said that alert fatigue is the most pressing challenge facing their SOC today.
- 88% responded that the volume of security alerts in their SOC had increased over the last 12 to 24 months.
- 46% having an increase greater than 25%.
Questions worth separating out
Q: How should SOC teams reduce alert fatigue without missing real threats?
A: SOC teams should reduce alert fatigue by correlating alerts with identity context, behavioural baselines, and business-critical assets before analysts see the queue.
Q: Why does identity context improve SIEM detection quality?
A: Identity context improves detection quality because the same event has very different meaning depending on whether it involves a normal user, a privileged administrator, a service account, or a workload.
Q: What signals indicate that risk scoring is working in the SOC?
A: Risk scoring is working when the highest-priority alerts consistently align with incidents that require investigation, while low-value noise declines in analyst queues.
Practitioner guidance
- Ingest identity context into every alert pipeline Join user, service account, workload, privilege, and asset metadata before alerts reach analysts so triage can reflect actor risk, not just event severity.
- Tune behavioural baselines by peer group and privilege level Build separate baselines for high-risk identities, privileged accounts, and business-critical assets so anomaly detection does not average away meaningful deviations.
- Normalize scoring across tools and queues Use one risk model to rank alerts from SIEM, UEBA, SOAR, and ITDR so the highest-impact cases surface consistently, regardless of source.
What's in the full article
Gurucul's full blog covers the operational detail this post intentionally leaves for the source:
- How its behavioral analytics pipeline correlates users, devices, applications, and environments into one detection workflow
- How the platform's 0 to 100 risk score is calculated across 240+ dynamic attributes for real-world triage
- How false positives are reduced in practice using context, baselining, and risk correlation rather than rule volume alone
- How analysts use integrated SIEM, UEBA, SOAR, DPM, and ITDR workflows to move from detection to response
👉 Read Gurucul's analysis of smart SIEM visibility, detections, and risk prioritization →
Smart SIEM visibility gaps: what SOC teams need to change?
Explore further
08/07/2026 7:26 pm
Identity context is now the deciding layer in SOC triage. Raw alert volume is not the main problem by itself. The problem is that organisations still ask analysts to interpret events without enough information about who or what the actor is, what privilege it holds, and whether the behaviour is normal for that identity. SOCs that do not merge identity and behaviour data will keep producing technically accurate but operationally useless detections.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams integrate SIEM, UEBA, SOAR, and ITDR without creating more noise?
A: Teams should integrate those tools through a shared identity and risk model, then route alerts into a common queue with clear severity and context fields. That prevents duplicate notifications and lets automation handle low-value cases while analysts focus on the incidents most likely to matter.
👉 Read our full editorial: Smart SIEM visibility and risk prioritization are reshaping SOC response
