Listen to this Post
Introduction: The SOC’s Quiet Crisis
Modern cybersecurity has a paradox at its heart: security teams have more visibility than ever, yet they are increasingly overwhelmed by what that visibility produces. Every endpoint, cloud workload, identity system, application, email gateway, SaaS platform and network device can generate security telemetry. The result is an enormous stream of alerts, many of which are technically correct but operationally insignificant.
For years, Security Operations Centres (SOCs) have responded by adding more analysts, better dashboards, automated playbooks and increasingly sophisticated security platforms. Now, artificial intelligence is being introduced as another layer of defence, with AI agents increasingly taking over the first stage of alert investigation.
That is a major improvement — but it may not be enough.
The central argument presented by Simon Phillips, CTO of CybaVerse, is that cybersecurity teams should stop thinking of AI merely as a replacement for the analyst who investigates alerts. Instead, AI can be moved further upstream into detection engineering, where it can help prevent unnecessary alerts from being generated in the first place.
This distinction is more important than it initially appears.
The Alert Flood Is Getting Worse
The modern SOC is drowning in data.
An organisation can generate thousands of security alerts every day, ranging from suspicious authentication attempts and endpoint detections to phishing reports, anomalous network connections and cloud security events.
The problem is not that all of these alerts are useless.
The problem is that a large percentage do not represent meaningful security incidents.
An analyst may receive an alert because an employee clicked a suspicious link, only to discover that the link was blocked before anything happened. Another alert may indicate unusual authentication behaviour that turns out to be a legitimate employee travelling between locations. A malware detection may involve a file that was already quarantined automatically.
Each event still consumes attention.
The Hidden Cost of False Positives
False positives are often treated as an inconvenience, but their consequences can be much more serious.
Every unnecessary investigation consumes analyst time. When hundreds or thousands of low-value events arrive continuously, analysts are forced to divide their attention between routine investigations and potentially catastrophic incidents.
That creates an uncomfortable mathematical problem.
If a SOC analyst must investigate hundreds of low-risk events, there is less cognitive capacity available for the one event that genuinely matters.
The attacker does not need every alert to be ignored.
They only need an important alert to be overlooked once.
Why Alert Fatigue Becomes a Security Risk
Alert fatigue is not simply an employee wellbeing issue.
It is a security-control problem.
Repeated exposure to low-value alerts can cause analysts to become increasingly reliant on familiar patterns, automation and assumptions. Over time, the human brain naturally begins prioritising speed over exhaustive investigation.
That is understandable.
No analyst can maintain maximum concentration indefinitely while processing a constant stream of repetitive alerts.
This is one reason burnout has become such an important concern within security operations. The SOC environment can combine high workloads, unpredictable incidents, constant escalation pressure and the knowledge that missing a single critical event could have severe consequences.
AI Arrives as the First Line of Defence
Artificial intelligence offers an obvious solution.
Instead of sending every alert directly to a human analyst, an AI-powered system can perform the initial investigation.
It can collect additional context, correlate related events, examine user behaviour, inspect endpoint telemetry and determine whether an incident appears malicious.
The human analyst then reviews the
That can dramatically reduce repetitive work.
The Problem With Investigating Faster
But there is a deeper question.
What if the organisation is simply investigating unnecessary alerts more efficiently?
This is the key weakness in an alert-centric approach.
If an organisation generates 10,000 alerts and AI successfully investigates 9,000 of them, the SOC may feel significantly more efficient. Yet the underlying detection environment still produces 10,000 alerts.
The noise has not disappeared.
The organisation has simply built a faster machine for processing it.
Moving AI Upstream
This is where the concept of upstream AI becomes particularly interesting.
Instead of waiting until an alert becomes an incident, AI can be used earlier in the security lifecycle.
Its job is no longer simply to answer:
“Is this alert malicious?”
It can instead help answer:
“Should this event have generated an alert at all?”
That is a fundamentally different question.
Detection Engineering Becomes the New AI Frontier
Detection engineering is the process of designing, testing, tuning and maintaining the logic used to identify suspicious activity.
Traditionally, this requires security engineers to understand attacker behaviour, analyse telemetry, write detection rules, test them against legitimate activity and continuously tune them.
AI can assist with many of these tasks.
It can analyse detection logic, identify unnecessary conditions, suggest correlations, evaluate historical false positives and help engineers create more precise rules.
Instead of putting AI at the end of the detection pipeline, organisations can place it much closer to the beginning.
The Phishing Example
Consider a common phishing scenario.
An employee reports a suspicious email.
A traditional system may immediately create an incident.
The SOC then investigates the message, examines the sender, checks the destination URL, determines whether the recipient clicked it, searches for other recipients and looks for evidence of compromise.
But imagine if those checks happened automatically before an incident entered the SOC queue.
If the email was blocked, nobody clicked the link, no other employees received it and there was no associated malicious activity, the system could classify the event as low risk.
There may be no reason to create a human investigation ticket.
Preventing the Alert Instead of Explaining It
This is the central philosophical shift.
Traditional automation asks:
“How can we investigate this alert faster?”
Upstream detection engineering asks:
“How can we prevent this low-value alert from reaching the investigation stage?”
The second question attacks the source of the problem.
That could have a much larger impact on SOC efficiency.
AI and Security Economics
There is also a financial dimension.
Many security services and managed SOC providers operate partly around the volume of alerts they process.
More alerts can mean more compute, more investigation time, more storage, more automation and more analyst involvement.
Reducing unnecessary alerts before investigation therefore has the potential to lower operational costs.
The economic benefit becomes particularly significant for organisations operating large environments with millions or billions of security telemetry events.
The Data Privacy Advantage
Moving AI upstream could also reduce exposure to sensitive operational data.
AI investigation platforms may need access to logs, alerts, user information, endpoint telemetry and other security data to determine whether an incident is malicious.
That can create governance concerns.
Organisations operating under strict regulatory, contractual or internal security requirements may be reluctant to send sensitive operational information through external AI systems.
Detection engineering changes the equation.
AI Can Build the Logic Without Seeing Everything
An AI model can assist with creating or improving detection rules without necessarily requiring continuous access to live customer telemetry.
Once the logic has been reviewed, tested and approved, it can run locally within the organisation’s security environment.
This creates an important separation.
The AI helps build the security mechanism, while the security mechanism processes the operational data.
That architecture may prove attractive to enterprises concerned about data sovereignty and third-party AI exposure.
The Rise of Agentic Security
This approach also fits into the broader movement toward agentic AI in cybersecurity.
AI agents are increasingly being designed to perform multi-step tasks rather than simply answer questions.
A security agent can potentially examine detection logic, investigate historical behaviour, propose modifications, simulate outcomes and recommend changes to security workflows.
The critical requirement, however, is governance.
A detection rule that blocks legitimate business activity can be just as damaging as a detection rule that misses an attacker.
AI therefore should not receive unrestricted authority over production security controls simply because it can write them.
Human Oversight Still Matters
The strongest architecture is likely to be collaborative.
AI can generate hypotheses.
AI can identify patterns.
AI can suggest detection improvements.
AI can simulate potential false positives.
But experienced security engineers should remain responsible for approving high-impact changes.
This is particularly important when AI-generated detection logic interacts with identity systems, endpoint controls, network segmentation or automated response mechanisms.
Deep Analysis: Building an AI-Assisted Detection Pipeline
Start With Existing Detection Rules
Security teams should first identify which rules generate the largest number of alerts and which rules produce the highest percentage of false positives.
For organisations using Sigma-style detections, engineers can inspect rules locally with commands such as:
find detections/ -type f -name ".yml" | sort
The objective is not simply to count rules.
The objective is to determine which rules generate operational noise.
Search for High-Volume Events
If logs are stored in JSON format, analysts can begin investigating alert frequency with tools such as:
jq ‘.event_type’ alerts.json | sort | uniq -c | sort -nr | head -20
This can expose the event categories responsible for the greatest amount of noise.
Measure False-Positive Rates
A simple investigation workflow can compare total alerts with confirmed incidents:
python3 - <<'PY'
total = 10000
confirmed = 240
false_positive_rate = (total - confirmed) / total 100
print(f"False-positive rate: {false_positive_rate:.2f}%")
PY
The exact numbers will vary by environment, but the principle is important: detection quality must be measured rather than assumed.
Test Detection Logic Before Deployment
Detection rules should ideally be tested against representative benign and malicious datasets before being deployed into production.
For Sigma-based workflows, a rule can be inspected and validated with:
sigma check detection.yml
Organisations should then test whether the detection catches relevant attacker behaviour without creating unnecessary alerts.
Search for Correlated Evidence
A single event may look suspicious while becoming harmless when additional context is available.
Security teams can investigate related events using SIEM queries or command-line pipelines such as:
grep -Ei "phishing|malware|suspicious|credential|powershell" security.log | tail -100
In production environments, equivalent searches should be performed through the organisation’s SIEM or security data platform.
Introduce Risk-Based Filtering
Rather than treating every suspicious event equally, organisations can introduce contextual scoring.
For example, an alert could become more important when several independent signals appear together:
Suspicious email
+
User clicked URL
+
Credential submission detected
+
New authentication from unusual location
=
High-priority investigation
The individual events may not justify a critical alert.
Their combination might.
Build Detection Before Automation
The most important engineering principle is simple:
Do not automate bad detection logic.
If a rule produces thousands of irrelevant alerts, putting an AI investigator behind it may reduce the human workload but preserve the underlying inefficiency.
Fix the rule first.
Then automate what remains.
What Undercode Say: AI Should Reduce Noise, Not Just Process It
1. The SOC Has an Architecture Problem
Alert fatigue is often described as an analyst problem, but the deeper issue is architectural.
- More Telemetry Does Not Automatically Mean Better Security
Visibility is valuable only when security teams can interpret and act on what they see.
3. AI Is Excellent at Repetitive Investigation
That makes AI agents particularly useful for first-line security operations.
4. But Investigation Is Already Downstream
By the time an alert reaches the analyst, the organisation has already paid the operational cost of generating it.
5. Upstream AI Changes the Economics
Preventing an unnecessary alert can be more efficient than investigating it.
6. Detection Engineering Deserves More Attention
Security teams often invest heavily in SIEM platforms while underinvesting in detection quality.
7. Better Rules Can Beat More Analysts
A precise detection that produces fewer, higher-quality alerts can deliver enormous operational value.
8. AI Can Accelerate Detection Development
Models can review large numbers of rules far faster than human engineers.
9. Historical Data Can Reveal Weak Detection
AI can identify rules that repeatedly generate benign events.
10. Context Is the Missing Ingredient
A suspicious event becomes much more meaningful when correlated with identity, endpoint and network information.
11. Correlation Should Happen Earlier
There is little value in generating separate incidents for events that can immediately be correlated into a single risk assessment.
12. Phishing Is a Perfect Example
A suspicious email does not necessarily equal a security incident.
13. User Behaviour Can Change the Verdict
Whether the recipient clicked, downloaded or entered credentials can dramatically alter the risk.
14. AI Can Perform Those Checks Quickly
That reduces unnecessary escalation.
15. The Same Principle Applies Everywhere
Cloud, identity, endpoint and network detections can all benefit from contextual filtering.
16. Identity Security Is Especially Important
A suspicious login may be legitimate when supported by known travel or device context.
17. Endpoint Security Also Produces Noise
Security tools frequently detect potentially unwanted behaviour that never becomes malicious.
- AI Can Help Separate Signal From Behavioural Noise
But it needs reliable telemetry and carefully designed policies.
- AI Should Not Become a Black Box
Security engineers must understand why a detection was changed.
20. Explainability Matters
A security team needs to defend detection decisions during audits and investigations.
- Version Control Should Apply to Detection Rules
Security logic should be treated like software.
22. Every AI-Generated Rule Should Be Traceable
Teams should know what changed, when it changed and why.
23. Testing Must Become Continuous
A rule that works today may become noisy after an application, identity system or network architecture changes.
24. Attackers Adapt
Detection engineering therefore cannot be a one-time project.
25. AI Can Help With Continuous Tuning
But humans should retain control over production changes.
26. Security Automation Needs Guardrails
The more authority an AI agent receives, the greater the consequences of an incorrect decision.
- Autonomous Blocking Is a Different Risk Category
Generating a recommendation is much safer than automatically disabling an account or blocking production traffic.
28. Privacy Is Another Major Advantage
Using AI to create detection logic may reduce the amount of sensitive operational data sent to external models.
29. Data Sovereignty Will Become More Important
Enterprises increasingly need to know where security data is processed and stored.
30. AI Security Needs Its Own Security
Models can hallucinate, misunderstand context or generate flawed logic.
31. Prompt Injection Is Also Relevant
AI connected to security systems must be protected from malicious content embedded inside the data it processes.
- Detection Engineering Should Become an AI-Assisted Discipline
The goal should not be replacing security engineers.
- The Goal Should Be Multiplying Their Effectiveness
One skilled engineer supported by intelligent tooling can potentially maintain a much larger detection estate.
- The Best SOC May Be the One That Generates Fewer Alerts
That sounds obvious, but the industry has historically measured security visibility more readily than alert quality.
- Alert Volume Should Not Be the Success Metric
Detection precision and incident relevance are far more meaningful.
36. AI Can Help Shift the Metric
Security leaders should measure how many alerts become meaningful investigations.
37. Fewer Alerts Can Mean Better Security
If the reduction comes from eliminating noise rather than hiding threats.
38. This Distinction Is Critical
A poorly configured filter can make a SOC look efficient while making the organisation less secure.
39. The Future Will Combine Both Approaches
AI investigators will still have a role, but upstream AI-assisted detection engineering may become equally important.
40. The Real Objective Is Simple
Cybersecurity teams should not merely investigate threats faster.
They should engineer their environments so that the most valuable threats are the ones that rise to the top.
✅ Alert Fatigue Is a Genuine SOC Challenge
The article correctly identifies alert overload and false positives as longstanding operational problems for security teams. High alert volumes can consume analyst time and contribute to fatigue, burnout and reduced investigative effectiveness.
✅ AI Is Increasingly Used for Security Operations
AI and machine-learning technologies are already being incorporated into security monitoring, alert triage, threat detection and investigation workflows. The concept of using AI for first-line analysis is therefore technically credible.
✅ Upstream Detection Engineering Is a Valid Strategy
Improving detection logic before events reach analysts is a recognised security engineering principle. Correlation, filtering, tuning and contextual enrichment can reduce unnecessary investigations.
❌ AI Does Not Automatically Eliminate Alert Fatigue
Simply inserting an AI agent between alerts and analysts does not guarantee that the underlying detection problem has been solved. Poor-quality detections can still consume compute, storage and operational resources even when machines perform the investigation.
⚠️ AI-Generated Detection Rules Still Require Validation
AI can produce incorrect logic, misunderstand organisational context or introduce unexpected false positives. Human review, testing, version control and controlled deployment remain essential.
⚠️ Data-Privacy Benefits Depend on Architecture
Using AI for detection engineering can reduce exposure of live operational data, but the actual privacy advantage depends on where the model runs, what information is provided to it and how generated detection logic is validated.
Prediction
(+1) AI Will Move Earlier Into the Security Detection Lifecycle
Over the next several years, the cybersecurity industry is likely to move beyond the idea of AI simply acting as an automated Tier-1 analyst.
The more powerful development will be AI-assisted security engineering: systems that continuously inspect detection quality, identify false-positive patterns, recommend correlation logic, simulate detections and help security engineers optimise the rules responsible for generating alerts.
This will not eliminate SOC analysts.
Instead, it could fundamentally change what they spend their time doing.
Rather than manually investigating hundreds of repetitive alerts, analysts could focus on sophisticated intrusion investigations, threat hunting, detection strategy and validating AI-generated recommendations.
(-1) Poorly Governed Security AI Could Create a New Generation of Noise
There is also a serious downside.
If organisations deploy AI agents without proper testing, they could end up generating automated detection rules faster than humans can validate them.
That could produce a new form of alert fatigue — one created by machines.
The industry therefore needs to avoid confusing automation with intelligence.
The strongest security organisations will not be those that deploy the most AI agents.
They will be the ones that use AI to make their entire detection architecture quieter, more precise and more resilient.
The Bigger Picture: Stop Measuring Security by Alert Volume
The future of the SOC should not be measured by how many alerts it can process.
It should be measured by how effectively it identifies genuine threats.
That requires a fundamental change in mindset.
Security teams should stop asking whether they can investigate another thousand alerts and start asking why those thousand alerts were generated in the first place.
AI has the potential to become one of the most important tools in that transformation.
But its greatest contribution may not be replacing the analyst sitting at the end of the alert pipeline.
It may be helping engineers redesign the pipeline itself.
Because the ultimate goal of cybersecurity is not to build a faster machine for processing noise.
It is to make sure the signal is strong enough that the right threat gets noticed when it matters most.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.itsecurityguru.org
Extra Source Hub (Possible Sources for article):
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
