We’re on the edge of something interesting in the industry right now, and it’s the transformation of the modern SOC.
We Know the Problem
Everyone knows that security operations centres are faced with too much, too hard, and too fast – not to mention too confusing. We know the stats: thanks to the cyber talent crunch, limited resources, and a ton of new attacks (thanks, bots and AI), 40% of alerts get ignored. Even worse, 61% of security teams admit to ignoring alerts that later proved to be critical incidents.
We’ve Dipped Our Toe in the Solution
The simple answer is “figure out how to get less alerts.” Check. Reducing noise is key. But once you do, is the problem solved?
No, but you’re on the right track. The next step is where the transformation really takes place, and where the industry is looking to go next. We’ve talked noise reduction, but now, what we need when we’ve only got a few (ish) alerts is to know is which one of those is worth our time? If we can only get to five a day, which ones should we be going after? And what determines what comes next on our roster?
Let’s Go All the Way
The answer is risk. You need to prioritise those remaining few (hundred) alerts by risk, which is a multifaceted project, then streamline remediations based on which ones present the biggest, most immediate, or most impactful threat.
Reducing noise is a good start, but it’s only that. Here’s where we jump off, and how to build a risk-first alert pipeline that analysts trust. And that will truly have the power to transform the SOC.
First, Let’s Talk Noise Reduction
Before we jump to the conclusion, let’s orient ourselves and look at where we’ve come from.
Nobody Can Function with Alert Fatigue
Faced with an average of 83 different tools from 29 different vendors, SOCs are forced to wade through deluges of data to find the rare, true positive needle in a haystack.
It doesn’t come easy, and SOCs waste most of their time looking. That’s why it’s so important to, before anything else can get better, cut the noise. Prophet Security, an AI SOC Platform company, does a great job of explaining the process of reducing alert fatigue, but then adds this insightful conclusion: “Do not chase volume alone. Reducing alert count without measuring risk impact creates blind spots.”
Cutting Down Alerts? It’s a Good Start
And this is the jumping off point. Having fewer alerts is, well, good. But those still have to be actioned on and someone has to decide which comes first. Typically, SOCs make that decision based on severity scores. It’s the way the industry does things, it’s the way we’ve always done things.
But these days, security no longer exists in a vacuum and “how big a deal” a certain exposure is really doesn’t matter if it isn’t a big deal to the business. Today, all security priorities are intrinsically tied to business objectives – it’s about time! – which means that the alerts that represent the biggest overall business risk are the ones that need to be taken care of first.
So, how do you do that?
Determining Risk to the Business: The Real Metric
We’ve carried the ball halfway down the court, and now it’s time to sink it in. To really help SOCs out, any sort of automated SOC tool needs to do more than cut down on noise. It needs to tell you what to do with the alerts that are left, and tie those decisions transparently to:
- Asset criticality. Is this a moderate severity vuln on a database holding cardholder information? That’s huge. Or is it a critical vulnerability on a stale on-premises database that holds no secrets? Not as big of a deal.
- How likely is this to be exploited? Are there currently strong security controls surrounding this asset, blocking any potential attacks? We can wait on the fix, then. Are there zero policies in place, meaning all an attacker has to do is compromise this one weakness and they’re in? Put that higher on the list.
- Risk to the business. If this vulnerable system goes down, what’s the worst that can happen? Is it a SCADA system or an API connecting highly regulated data? Priority one. Is it a retired server that’s been languishing in the digital corner? You get the point.
Looking at these other angles shows why simple severity scores won’t cut it. They say nothing of the context around the exposure; what it’s putting at risk, how real that risk might be, the impact if that risk becomes a real threat or gets exploited.
All these things need to be taken into account by your automated SOC tool if it’s going to do more than give you more puzzles to solve. SOCs have enough on their plates; these types of answers should come standard.
So, what’s the technology that can get it done?
A Modern, Risk-First Alert Pipeline
When looking for the right AI SOC platform, it needs to be one that will do this sort of math for you, not take out a bunch of alerts, hand you the rest, and say “good luck.”
That’s why you want one with a modern, risk-first alert pipeline. This sounds like a bunch of security-ish buzzwords strung together with hyphens, but it’s really where the magic takes place.
Can AI Help? Yes.
But first, does AI help? In 2025, you don’t have to ask. Yes, artificial intelligence helps in this whole process. Like with most technologies, applying AI, generative AI, machine learning, agentic AI, natural language processing, and everything AI can move the needle significantly; but only when used in the right way.
Building Out Alerts by True Risk
Here’s what a risk-first alert pipeline looks like in action:
- Upstream Filtering: AI agents, especially agentic AI agents, ingest alerts and analyse them (early in the pipeline, or at the source). They filter out false positives here, leaving less mess to work with downstream.
- User Behaviour: Helps filter out false positives by comparing normal baselines to existing identity and session activity.
- Contextual Enrichment: Using only the alerts that aren’t marked duplicates or false positives, autonomous AI agents get to work. They gather and correlate data from all relevant sources (SIEMs, cloud logs, identity platforms, EDR) to build the beefed-up attack story and deliver SOCs alerts they can use. Right away.
- Contextual Reasoning: You can’t chase dynamic threats with static rules. Agile, agentic AI agents “think” on the spot (using LLMs and domain-specific data) to make conclusions about the evidence, ask investigative questions, and come up with next steps.
- Blended Scoring: The ultimate, prioritised list should be one where multiple factors have been taken into account: severity (yes), context (SIEMs, EDR, etc.), behavioural analytics (does surrounding system behaviour deviate from the norm?), and confidence scoring (how “right” the AI thinks its reasoning is, so SOCs know what they’re working with). All AI-based decisions should be transparent and auditable to boost trust; no “black box” scoring.
The result is that you get your alerts not only thinned out, but organised by order of importance to the business, not an arbitrary security scoring chart. Don’t misunderstand; severity needs to be factored in, too. It just can’t be the only factor.
The Benefit of a Risk-First Alert Model
With a risk-first alert model, SOCs can place their limited resources where it counts, instead of chasing down alerts that may not have been the best use of company time.
This means that security teams look really good when presenting to boards at the end of the year, and that non-security board members can immediately grasp why SOCs did what they did, how that positively impacted the business, and where their money was going.
And, most importantly, be happy with it.
