Our Top 3 Insights on Alert Fatigue in Cybersecurity

Christian Wiens Director of Marketing

Christian Wiens is Director of Marketing at MixMode. He has 10+ years of experience as a cybersecurity professional. He has his BA from The University of California, Berkeley and resides in Austin, TX.

Alert fatigue is a top pain point in cybersecurity right now.

Security operations center (SOC) analysts are chasing an overwhelming amount of false positive alerts taking time away from analyzing and remediating actual security threats. According to a recent study:

70% of security professionals investigate more than ten alerts every day.
78% said that it takes over 10 minutes to look into each alert.
Almost half of respondents reported that 50% or higher alerts are false positives.
35% said their SOC has either tried to increase staff by hiring more analysts or turned off high-volume alerting features.

We have also been reporting on the false positives problems in network security throughout this year knowing the threat environment continues to evolve, and so should security teams views on finding ways to solve the issue that works best for their operation.

Here are our top 3 articles from 2019 on alert fatigue in cybersecurity:

Too Many Alerts: A National Security Threat?

Does the security industry realize that it is facing a massive personnel problem that is getting bigger every day and will soon boil over?

Do they realize that this chasm is creating risks that are brutal and unsustainable?

Is this a national security threat, really? Or is this an overstatement. We would argue that it is 100% true and the problem gets bigger by the day. There is a great deal of data to support these problems. (McAfee and Ponemon data around open analyst positions and also around data for alert volumes and false positives. Zero day alert increases.)

Despite the evidence of these problems, the industry is not moving very quickly to solve them.

Why? The answer is simple: Money.
Continue Reading

False Positives and Negatives: The Plague of Cybersecurity Software

Many resources are wasted when your IT department is forced to sift through the avalanche of security threats that are triggered daily to locate and respond to false negative or positive security alerts.

A policy that encourages employees to disregard security threats, no matter how small, can leave your company vulnerable to data privacy breaches and other cyber attacks.

Whether your network analysts are spending too much time on false positives or neglecting to recognize false negatives, when actual cyber threats go unnoticed, fear not.

The good news is that an effective solution is within your reach. Advances in cybersecurity have led to a new generation of smart technology that can help you proactively combat the issue of both false negatives and positives.
Continue Reading

How MixMode’s AI Builds Your Network’s Baseline

Mixmode’s platform utilizes unsupervised AI (also known as context-aware or third-wave AI) to inform the user of threats (including Zero-Day, and encrypted traffic) on their network, and reduces the rate of false positives in intel and alerts consistently by 90% or more. In addition to being efficient, one of the key characteristics of the design is that it is transparent.

Here we describe the type of information that Mixmode’s AI system “looks” at for decision-making, and emphasize how it is human-like in behavior but with a substantially enhanced computational capacity.
Continue Reading