AI is changing the threat landscape. Actions that once required significant time and expertise can now be automated, allowing attackers to probe environments, identify weaknesses, and pursue targets at scale. In the last few months, we’ve seen attacks on <a href="https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions” rel=”nofollow noopener” target=”_blank”>US water utilities across 12 states and medical device companies impacting the distribution of life-saving products, to name a few.
However, for defenders, there is no equivalent shortcut. Each potential threat still needs to be assessed, investigated, and understood. As the volume of vulnerabilities and suspicious activity increases, Security Operations Center teams (SOCs) face a difficult question: how do you identify what really matters when there are more threats than your team has the capacity to investigate?
New research finds that enterprise SOCs receive an average of 2,047 alerts every day. Of these, around 300 are ignored because teams lack the resources to investigate them, placing organizations at risk daily. In the bigger picture, the research finds organizations miss 37% of the vulnerabilities they face, contributing to an average annual cost of $5.1 million in damage and remediation.
The growing volume of security alerts creates another challenge for SOCs: information overload which can lead to ‘alert fatigue.’ In fact, 91% of CISOs say their organization suffers from information overload. This is often caused by AI generating more information for analysts to process, as the volume of telemetry, intelligence and alerts increases for already stretched security teams. And this pressure is already taking its toll. More than half of SOCs worry that they will miss an alert indicating a major breach, while just 34% say they have all the resources and skilled people they need to operate effectively.
Tackling the new normal for security teams
Security teams need to move beyond simply collecting telemetry and responding to the loudest alerts. As the data volume continues to grow, SOCs need to change their relationship with data. This means using automated incident response to investigate threats, connect evidence and surface the context analysts need to make confident decisions at speed. SOC leaders know this change is needed as 81% say the only way to prevent data overload is hunting down and dealing with the threats earlier.
This means moving beyond a shallow understanding based on telemetry alone. Security teams need to be able to quickly establish what happened, how it happened, what systems or data may be affected, and what the consequences could be. This understanding cannot depend solely on the most experienced investigators having the time to dig through the evidence. Automating the process can take on more of the time-consuming investigative work, allowing analysts to focus their expertise where it matters most.
Giving SOCs back the power to act
As AI continues to accelerate attacks and increase the volume of security data, SOCs cannot afford to treat every piece of information equally. The future of effective threat detection will depend on how quickly teams can turn data into clear, contextual and actionable understanding. Because when 300 potential threats can be left unexplored in a single day, the biggest risk may not be a lack of information but drowning in it.
A cybersecurity professional with more than 25 years of experience across the US Department of Defence and civilian sectors. Jeremy has extensive hands-on expertise in digital forensics and incident response, with a career spanning threat detection, cybersecurity, and national security. His experience includes serving as Threat Detection Lead at the Missile Defense Agency and as a security professional at the Y-12 National Security Complex.
