A report from Splunk reveals the state of security operations centers (SOCs) in 2025, indicating they are overworked and struggling to manage alerts. In a survey of 2,058 security leaders, 52% state their SOCs are overworked. 59% receive too many alerts, indicating that chasing alerts is a notable source of inefficiency.

57% lose essential time during investigations due to shortcomings in data management strategies. Furthermore, 46% of respondents report spending more time on maintenance (such as configuring or troubleshooting tool) than strategic investigation or threat mitigation. 

78% of those surveyed indicate that security tools are dispersed. This disconnect causes moderate to significant challenges, according to 69% of respondents. Respondents state that implementing a unified platform led to quicker incident response (59%) and less tool maintenance (53%).