Alert fatigue is the most discussed problem in security operations, and also the one most often described with figures nobody can trace back to a survey. This page collects sourced industry statistics on SOC alert volumes, false positives, the share of alerts never investigated, how long alerts wait, and the workload and stress analysts report. Every figure carries the report, the publisher, the sample and the year, taken from the publisher's own page. Most of these surveys are run or sponsored by security vendors, so the methodology section explains how to use them without overreaching. Definitions of SOC metrics and how to measure them yourself are in the Security Operations Metrics Guide. It is written for SOC managers, detection engineers and security leaders making the case for tuning, automation or headcount. Last reviewed: November 2026.
Key takeaways
- A typical SOC sees about 100 alerts a day, and many see far more. The Prophet Security State of AI in the SOC 2026 survey of 250 security leaders and practitioners puts the median at about 100 alerts a day, with 27% of organisations receiving 500 or more.
- Roughly a fifth to a quarter of alerts are never looked at. The same 2026 survey reports a median of 22% of alerts left uninvestigated, and 39% of organisations leave 30% or more untouched.
- Ignored alerts come back as incidents. Prophet Security 2026 finds 60% of respondents say an alert they ignored later proved material, and 40% have disabled, or may disable, a detection rule for lack of resources.
- False positives are the top detection problem. The SANS 2025 Detection and Response Report finds 73% of respondents cite false positives as their top detection challenge, up from 64% the year before.
- Workload pushes people out of the field. The Splunk State of Security 2025 survey of 2,058 security leaders finds 52% say their team is overworked and 52% say job stress has made them consider leaving cyber security altogether.
Headline statistics
The table gives the most requested figures from the latest edition we could read on each publisher's own site in November 2026.
| Statistic | Figure | Source, publisher and year |
|---|---|---|
| Median alerts per day | About 100 (mean near 1,000, pushed up by the largest environments) | State of AI in the SOC 2026, Prophet Security (fielded by ViB) |
| Organisations receiving 500 or more alerts a day | 27% | State of AI in the SOC 2026, Prophet Security |
| Median share of alerts left uninvestigated | 22% (average about 28%) | State of AI in the SOC 2026, Prophet Security |
| Respondents whose ignored alert later proved material | 60% | State of AI in the SOC 2026, Prophet Security |
| False positives cited as top detection challenge | 73% (64% in 2024) | SANS 2025 Detection and Response Report |
| Security teams with too many alerts | 59% | State of Security 2025, Splunk (Cisco) with Oxford Economics |
| Security teams with too many false positives | 55% | State of Security 2025, Splunk |
| Share of alerts practitioners say they can deal with | 38% | 2024 State of Threat Detection and Response, Vectra AI |
| Teams describing themselves as overworked | 52% | State of Security 2025, Splunk |
| Considered leaving cyber security due to job stress | 52% | State of Security 2025, Splunk |
Alert volume and team size
The Prophet Security State of AI in the SOC 2026 survey, the second annual edition, was fielded by the research firm ViB among 250 security leaders and practitioners and published in August 2026. It gives the most granular recent figures on volume.
| Measure | Figure (Prophet Security 2026) | What it tells you |
|---|---|---|
| Median alerts per day | About 100 | The typical organisation, not the large enterprise; useful for small and mid-sized benchmarking |
| Mean alerts per day | Close to 1,000 | Skewed by the largest environments: quote the median unless you are one of them |
| Receiving 50 or more alerts a day | 74% | Most SOCs exceed what one analyst can investigate thoroughly in a shift |
| Receiving 500 or more alerts a day | 27% | At this volume triage without automation means unread alerts |
| Fewer than five full-time analysts | 18% | Small teams carry the same alert sources as large ones |
| Five to nine analysts | 17% | Barely enough for 24x7 cover on a single seat |
| More than 100 analysts | 22% | The large enterprise and service provider segment |
Set against the 45 minute median investigation time in the next section, 100 alerts a day is about 75 analyst hours of thorough investigation, roughly nine to ten eight-hour shifts. This is NHI Mgmt Group's own arithmetic from the survey medians, not a figure the survey reports, but it shows why the uninvestigated share is not zero. See the SOC Staffing and Shift Models Guide for how teams size cover.
Investigation and wait times
- Time to investigate: Prophet Security 2026 reports a thorough investigation averages about 75 minutes, with a median near 45 minutes, and 64% of teams have a mean time to investigate of 30 minutes or more.
- Alert dwell time: the same survey defines alert dwell time as the wait before an analyst picks up an alert. It averages 55 minutes, with a median of 23, and pickup takes more than 15 minutes in 60% of teams.
- Against attacker speed: the CrowdStrike 2026 Global Threat Report gives an average eCrime breakout time of 29 minutes. A 23 minute median wait plus a 45 minute median investigation means the typical alert is understood after the average attacker has moved laterally. The Incident Response Statistics page covers attacker speed in more detail.
Uninvestigated alerts and disabled detections
The share of alerts nobody looks at is the statistic security leaders most often ask for. Two surveys measure it in different ways, and they should not be blended.
| Measure | Figure | Source, sample and year |
|---|---|---|
| Share of alerts left uninvestigated | Median 22%, average about 28% | Prophet Security, 250 respondents, 2026 |
| Organisations leaving 30% or more of alerts untouched | 39% | Prophet Security, 2026 |
| An ignored alert later proved material | 60% of respondents | Prophet Security, 2026 |
| Three or more such incidents in 12 months | 34% | Prophet Security, 2026 |
| Disabled, or may disable, a detection rule for lack of resources | 40% | Prophet Security, 2026 |
| Share of alerts practitioners say they can deal with | 38% | Vectra AI, 2,000 security professionals, 2024 |
- Disabled rules are invisible risk: a rule turned off to cut noise produces no alert and no uninvestigated count. The 40% figure suggests many SOCs reduce workload by reducing coverage. The Alert Fatigue Reduction Guide covers tuning that cuts noise without creating blind spots.
- The older Vectra figure: the 38% capacity figure comes from a 2024 survey and is a self-assessment of capacity, not a measured rate. Use the 2026 data for current volumes and quote the Vectra figure with its year.
False positives and detection quality
- Top challenge: the SANS 2025 Detection and Response Report finds 73% of respondents cite false positives as their top detection challenge, up from 64% in 2024.
- Frequency: the same SANS report finds 60% encounter false positives frequently or very frequently, and 20% face them at very high rates, up from 13% the year before.
- Too many false positives: the Splunk State of Security 2025 survey finds 55% of respondents have to address too many false positives, and 59% say they have too many alerts.
- Real attacks: in the Vectra AI 2024 survey, practitioners classified 16% of the alerts they receive as real attacks. This is respondents' estimate, not a measured true positive rate.
- No reliable industry false positive rate: none of the primary sources we read publishes a single measured false positive percentage across SOCs. Figures quoting one exact industry-wide rate should be traced to their survey before use. Measure your own per rule disposition rates instead, as described in the Alert Triage Guide.
Workload, stress and retention
| Measure | Figure | Source and year |
|---|---|---|
| Team is overworked | 52% | Splunk State of Security 2025 |
| Face unrealistic expectations from leadership | 43% | Splunk State of Security 2025 |
| Job stress has made them consider leaving cyber security | 52% | Splunk State of Security 2025 |
| Spend more time maintaining tools than defending the organisation | 46% | Splunk State of Security 2025 |
| Tool maintenance is the main source of inefficiency | 59% | Splunk State of Security 2025 |
| Lack of skilled personnel is a top detection challenge | 59% | SANS 2025 Detection and Response Report |
| Skill gaps are a leading barrier to response | 56% | SANS 2025 Detection and Response Report |
The Splunk survey was conducted with Oxford Economics among 2,058 security leaders across nine countries and 16 industries between October and December 2024, and published on 20 May 2025. Workforce size and hiring figures are in the Security Workforce and Skills Gap Statistics Guide.
AI and automation in the SOC
- Why teams adopt AI: Prophet Security 2026 finds 37% cite reducing analyst burnout and turnover as a reason to adopt AI, and 46% of AI users cite a reduced false positive load on human reviewers as a measure of success.
- Reported effect on burnout: the Vectra AI 2024 survey found 73% of SOC practitioners said AI had reduced feelings of burnout over the previous 12 months.
- Caution: both figures come from vendors that sell AI for the SOC. They show what practitioners report, not a controlled measure of outcome. See the AI SOC Guide for how to evaluate AI triage on your own data.
What the numbers mean for defenders
| Finding | Priority response | NIST CSF 2.0 | SP 800-53 Rev. 5 |
|---|---|---|---|
| Median 22% of alerts uninvestigated | Measure your own uninvestigated share daily and treat it as a risk metric reported to leadership | DE.AE-02, ID.IM | IR-5 Incident Monitoring |
| 40% disable rules for lack of resources | Change control for rule disablement, with a coverage review and an expiry date | DE.CM | SI-4 System Monitoring |
| 73% cite false positives as top challenge | Per rule disposition tracking and correlation instead of single event alerts | DE.AE-03 | AU-6 Audit Record Review, Analysis, and Reporting |
| 23 minute median pickup against 29 minute breakout | Automated enrichment and priority queues for identity and lateral movement alerts | RS.AN, RS.MA | IR-4 Incident Handling |
| 52% overworked, 52% considered leaving | Staffing aligned to alert volume, rotation, and time for detection engineering | GV.RR-03 | PM-13 Security and Privacy Workforce |
- Volume is a design choice: much of the load is untuned vendor defaults and single event rules. Moving to risk based alerting reduces queue volume without removing detections. See the Correlation Rules and Risk Based Alerting Guide.
- Machine identity alerts deserve priority: alerts on API keys, service accounts and OAuth tokens are often low volume but high consequence, and are among the first dropped when queues overflow. See the Detection Engineering for Non-Human Identities Guide.
Methodology notes and caveats
- Vendor surveys: Prophet Security, Splunk and Vectra AI sell SOC technology. Their samples are respondents to commissioned surveys, not random samples of all SOCs. Use them to describe direction and scale, and quote sample size and year with every figure.
- SANS: the SANS surveys are community surveys with sponsor support. The 2025 Detection and Response key findings page does not state a total respondent count.
- Self-reported estimates: uninvestigated share, real attack share and capacity are respondents' estimates, not values extracted from SIEM data.
- Medians and means differ: alert volume is heavily skewed. A mean near 1,000 against a median near 100 shows why a single average misleads.
- Not used: the SANS 2025 SOC Survey (published July 2025) full report is behind a login, so no figures from it are quoted here.
Practitioner checklist
- Report alerts per day, per analyst and per rule every week, using medians as well as means.
- Track the share of alerts closed without investigation and set a target to reduce it.
- Measure alert pickup time and investigation time separately, and compare them with attacker breakout time.
- Require a ticket, owner, coverage note and review date for every disabled or suppressed detection rule.
- Tag every closed alert with a disposition and retire or rework rules with persistently high false positive rates.
- Prioritise alerts involving privileged and non-human identities in the queue.
- Track analyst overtime, on-call load and attrition alongside alert metrics.
- Test any AI or automation triage on a sample of your own historical alerts before trusting vendor figures.
Standards and references
- SANS Institute: 2025 Detection and Response Report, Key Findings
- Cisco Newsroom: Splunk State of Security 2025 findings
- Prophet Security: State of AI in the SOC 2026
- Vectra AI: 2024 State of Threat Detection and Response research
- CrowdStrike: 2026 Global Threat Report
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
Related NHI Mgmt Group resources: Security Operations Metrics Guide · Alert Fatigue Reduction Guide · SOC Guide · Incident Response Statistics · Top 10 SOC Challenges