Every security operations centre (SOC) starts the day with a backlog. The queue of alerts in the morning is already longer than most teams can manage, and it grows at a persistent rate because attackers have changed the attack parameters and perimeter.
The IBM 2026 Cost of a Data Breach Report notes that AI-driven attacks have increased by 56% year-on-year and one in four organisations have suffered an AI-driven malicious breach. Inside the SOC, signals are a flood and the intrusion buried behind the noise. A noise that the Microsoft State of the SOC 2026 study highlighted – around 46% of alerts are false positives, 42% are not investigated, 59% of tools push data to the SIEM so the SOC is left to manage data manually with very little visibility. The SOC is now overwhelmed by alert fatigue by default, increasing the need for automation and managed detection and response (MDR) solutions that fit the business case.
The difficulty, however, isn’t just the volume of alerts, but also the skills of the people who assess them. The 2025 ISC2 Cybersecurity Workforce Study found that the binding constraint in the SOC has moved from headcount to capability. Upwards of 59% of respondents cite skills shortages in their teams – an increase on the 44% of 2024. Companies are experiencing breaches or missing security vulnerabilities because of the skills shortage while the attackers, on the other hand, aren’t keeping office hours and aren’t worried about skilled personnel to execute their attacks.
This makes traditional detection insufficient as a methodology. The SOC that can see everything but can’t rank what it sees is only creating more noise. Endpoint behaviour detection is flooding the system with alerts alongside authentication events, and the SOC has to read the signals in the context of the business rather than by severity, whilst keeping up with the tsunami. Prioritisation is essential as it weighs the criticality of the asset, identity privilege, live threat intelligence and operational impact, simultaneously. A compromised mailbox belonging to the CFO authorising payments, for example, isn’t seen as the same problem as a dormant database account that has suddenly begun running scripts. The business context allows the SOC to determine which one it has to reach first.
AI-native detection, on the other hand, is earning its place within the SOC because it has the ability to cut the noise at the source. Rather than passing every anomaly through as a separate alert, it is capable of correlating related events and suppressing the low-value ones, so the analyst has to deal with fewer high-fidelity alerts and loses less of the day focusing on false positives. The tool doesn’t decide what to do about a genuine threat, but, configured correctly, it clears enough of the field for proficient human intervention.
Extended detection and response (XDR) builds on these tools by pulling endpoint and identity telemetry into a single view and collapsing what would have otherwise been a dozen separate alerts into one coherent incident. So if the SOC receives alerts about an impossible travel login, a new device and a privilege change, instead of seeing them as three unrelated notifications, they are assembled into a story that an analyst can assess quickly with the business context already attached.
MDR then closes the gap, particularly around skills, as it provides the business with the necessary automation to mitigate the need for round-the-clock analysts, while still giving it the ability to contain an incident timeously. It can isolate a device, roll back changes, or shut off a machine, buying teams time and reducing the load, without removing the human from the loop. The most critical assets are deliberately held back from automatic action so the person always decides.
This hesitation is essential. Automation governed by asset criticality alleviates the load but doesn’t create new risks because the actions are reversible and stakes are lowered. Consequential decisions stay with the analyst who understands business impact. Automation cannot be applied as a blanket solution because it would potentially treat payroll servers and test machines as equals. It is essential that escalation paths, workload thresholds and accountability are established before automation is turned on.
Intruders will always look for new ways to access the organisation, and the SOC’s current levels of overwhelm are only set to increase. Balancing the noise with the load comes down to intelligent automation that’s defined by business context, while scarce human expertise is spent where it counts. Handled this way, the SOC can prioritise more effectively and move away from drowning under the deluge of alerts and towards a more agile alert management environment.
