99% False Positives¶
Alahmadi, B. A., Axon, L., & Martinovic, I. (2022). 99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms. Proceedings of the 31st USENIX Security Symposium, 2783-2800.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Logistics Overreach
- In cybersecurity operations, a security operations centre adds monitored assets faster than analyst capacity grows, so alert backlog rises, detection time lengthens, and dormant compromises accumulate.
This sourceDocuments that the volume of monitored assets and alerts exceeds analyst triage capacity in security operations centres, producing alert backlog, longer detection time, and missed compromises; motivates scoped/capacity-tied monitoring expansion.
- In cybersecurity operations, a security operations centre adds monitored assets faster than analyst capacity grows, so alert backlog rises, detection time lengthens, and dormant compromises accumulate.
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Registry ID ref:42ca1b8a3add · see in the full table