Alert Fatigue in Security Operations Centres¶
Tariq, S., Baruwal Chhetri, M., Nepal, S., & Paris, C. (2025). Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities. ACM Computing Surveys, 57(9).
Cited by¶
2 citations across 2 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Habituation to Repeated Signal
- Cybersecurity SOCs ("alert fatigue"): SIEM and EDR alerts arrive in tens of thousands per analyst per shift, so the rational posture becomes triage by salience proxy, missing genuine attacks.
This sourcePeer-reviewed survey documenting SOC analysts overwhelmed by thousands of mostly-false-positive SIEM/EDR alerts per shift, causing desensitization and missed genuine threats.
Supported in partVerified against the work's full text
Source supports alert overload leading to desensitisation and missed real threats, but not the tens-of-thousands-per-shift volume or a 'rational triage by salience proxy' mechanism.
“This can lead to real threats being overlooked, posing potentially catastrophic risks to organisations.”
- Cybersecurity SOCs ("alert fatigue"): SIEM and EDR alerts arrive in tens of thousands per analyst per shift, so the rational posture becomes triage by salience proxy, missing genuine attacks.
- Operational Overextension
- In cybersecurity, a defender extends monitoring across an expanding attack surface faster than analyst headcount and tooling can keep up, and a routine incident finds the perimeter under-monitored.
This sourceDocuments how SOC alert volume across an expanding attack surface outgrows analyst headcount, creating coverage gaps and missed genuine threats — the cybersecurity instance of frontier outrunning backbone.
Supported in partVerified against the work's full text
The survey supports analysts being unable to keep up with rising alert volume despite tooling, with real threats overlooked; it does not frame this as monitoring extended across an expanding attack surface.
“SOC analysts are unable to keep up with the rapidly increasing volume of alerts even with the aid of specialised SOC tools”
- In cybersecurity, a defender extends monitoring across an expanding attack surface faster than analyst headcount and tooling can keep up, and a routine incident finds the perimeter under-monitored.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 2 of 2 citations: 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:c0e1056013a8 · see in the full table