How Much Alert Fatigue Actually is Threat Intel Fatigue?
summary
Claims concrete numbers: 25% of analyst time goes to false alerts, 80% report burnout, enterprises use ~17 threat feeds and one tested SIEM shows only 1 of 5 documented integrations still active (oldest inactive 5 years). Observed 3% drop in free feeds Aug–Oct from a 250-feed set. Recommends cataloging sources, measuring update frequency and false-positive rates, and running an automated passive evaluation of ~540 monitored feeds to retire noisy or outdated inputs.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:05Alert fatigue basics
- 2:56Causes of alert fatigue
- 4:23Threat intel source challenges
- 6:12Flawed threat intel approaches
- 9:09Better threat intel strategies
- 13:29Threat intel maturity
- 14:39Conclusion
- 15:01Q&A
- 16:56Sandboxing detections
- 19:02False positive rates
- 20:29Stats and monitoring
related talks
15mAnti-patterns in Security Monitoring
53mSecurity Operations 2018: What Is Working? What Is Not.
01mWhy Manual Security Operations are Failing in 2026
35mWhy Your Security Analysts Are Leaving and What You Can Do to Retain Them
16m'Give Me Structure': Synthesis and Evaluation of a (Network) Threat Analysis Process...
42mEverything Everywhere All at Once: A Guide to Alert Triage and Analysis
55mCyber Security vs. Statistics
42mThe Fault in Our Metrics: Rethinking How We Measure Detection & Response