The 2023 State of Threat Detection Research Report, released by Vectra AI, provides insight into the “spiral of more” that prevents security operations center (SOC) teams from effectively securing their organizations from cyberattacks. Based on a survey of 2,000 security operations (SecOps) analysts, the report breaks down why the current approach to security operations is not sustainable.

According to the report, manual alert triage costs organizations $3.3 billion annually in the U.S. alone, and security analysts are tasked with the massive undertaking of detecting, investigating and responding to threats as quickly and efficiently as possible while being challenged by an expanding attack surface and thousands of daily security alerts. The study found:

• 63% report the size of their attack surface has increased in the past three years.
• On average, SOC teams receive 4,484 alerts daily and spend nearly three hours a day manually triaging alerts.
• Security analysts are unable to deal with 67% of the daily alerts received, with 83% reporting that alerts are false positives and not worth their time.

Despite a majority of SOC analysts reporting their tools are effective, the combination of blind spots and a high volume of false positive alerts are preventing enterprises and their SOC teams from containing cyber risk. Without visibility across the entire IT infrastructure, organizations are not able to identify even the most common signs of an attack, including lateral movement, privilege escalation and cloud attack hijacking. The study also found:

• 97% of SOC analysts worry about missing a relevant security event because it’s buried under a flood of alerts, yet, the vast majority deem their tools effective overall.
• 41% believe alert overload is the norm because vendors are afraid of not flagging an event that could turn out to be important.
• 38% claim that security tools are purchased as a box-ticking exercise to meet compliance requirements, and 47% wish IT team members consulted them before investing in new products.

Faced with alert overload and repetitive, mundane tasks, two-thirds of security analysts report they are considering or actively leaving their jobs, a statistic that poses a long-term impact to the industry. The study found:

• Despite 74% of respondents claiming their job matches expectations, 67% are considering leaving or are actively leaving their job.
• Of the analysts considering leaving or actively leaving their role, 34% claim they don’t have the necessary tools to secure their organization.
• 55% of analysts claim they’re so busy that they feel like they’re doing the work of multiple people, and 52% believe working in the security sector is not a viable long-term career option.