Summary: Security Operations Center (SOC) practitioners are increasingly frustrated with their current threat detection tools, which create excessive alerts and hinder their ability to identify real threats. Despite growing confidence in their capabilities and optimism about AI’s potential, many practitioners feel overwhelmed by the number of tools and alerts they manage, leading to a search for more effective solutions like extended detection and response (XDR).
Threat Actor: N/A | N/A
Victim: SOC Practitioners | SOC Practitioners
Key Point :
- 71% of SOC practitioners worry about missing real attacks due to excessive alerts.
- 60% believe vendors are selling tools that create too much noise and increase workload.
- 85% have increased their investment in AI for threat detection over the past year.
- 75% say AI has reduced their workload and 73% report decreased feelings of burnout.
- There is a strong intent to adopt more AI-powered tools to replace legacy systems.
Security operations center (SOC) practitioners believe they are losing the battle detecting and prioritizing real threats – due to too many siloed tools and a lack of accurate attack signal, according to Vectra AI.
They cite a growing distrust in vendors, believing their tools can be more of a hindrance than help in spotting real attacks. This is at odds with growing confidence in their teams’ abilities and a sense of optimism around the promise of AI.
GenAI tools create new opportunities for attackers
The hybrid attack landscape continues to expand as organizations increasingly turn to GenAI– powered tools to streamline processes and enhance their work. This creates more opportunities for attackers and challenges for security teams who are already struggling with security alert noise and false positives.
Even though SOC teams are more confident in their defenses than they were a year ago, many feel they do not have the right tools to help them effectively detect and prioritize real threats.
Security practitioners are increasingly confident in their capabilities but feel they are losing ground when it comes to detecting and prioritizing real threats. So, what is the disconnect? Many SOC teams are managing too many tools and still struggle with an overwhelming number of alerts, leading to concerns about missing critical threats. This is driving a lack of confidence and trust in the current threat detection tools practitioners are using and resulting in practitioners seeking alternative solutions, such as extended detection and response (XDR) solutions.
71% of SOC practitioners worry they will miss a real attack buried in a flood of alerts and 51% believe they cannot keep pace with the increasing number of security threats. 47% do not trust their tools to work the way they need them to work, while 54% say the tools they work with actually increase the SOC workload instead of reducing it.
73% have more than 10 tools in place and 45% have more than 20 tools. 62% of teams have either recently adopted or are exploring extended detection and response (XDR) solutions.
SOC teams struggle with security tools
SOC teams are increasingly frustrated with their current security tools, which are causing more challenges than they solve. Many practitioners find themselves pushing aside critical tasks to manage the overwhelming alert volume they receive, leading to dissatisfaction not only with the tools but also with the vendors providing them.
Practitioners also continue to struggle with alert accuracy, with a significant number of alerts going unaddressed due to time constraints and insufficient tool support. While there are signs of improvement in areas like visibility across hybrid environments, the overwhelming volume of alerts remains a significant issue.
60% of SOC practitioners say vendors are selling threat detection tools that create too much noise and too many alerts, while 71% say vendors need to take more responsibility for failing to stop a breach.
81% spend more than 2 hours per day digging through / triaging security events. 50% say their security tools are more of a hindrance than help when it comes to spotting real attacks, noting that realistically, they are only able to deal with 38% of the alerts they receive, while they would classify 16% of them as “real attacks.”
60% say a lot of their security tools are bought as a “box ticking” exercise for compliance.
Adoption and trust in AI for threat detection is growing
SOCs are increasingly adopting AI to improve threat detection and response, driven by a growing trust in AI’s capabilities.
While many practitioners are optimistic about AI’s potential to deliver threat signal efficacy to accurately identify and respond to threats, reduce workloads and replace legacy tools, there are still concerns about adding complexity to an already overwhelmed system. Despite the challenges, there is a strong intent to invest more in AI- powered solutions to enhance efficiency and efficacy.
However, for AI to truly gain widespread acceptance, vendors must work to rebuild trust by delivering tools that add real value without increasing the burden on SOC teams.
85% of SOC practitioners say their level of investment and use of AI has increased in the last year, with 67% noting that AI has had a positive impact on their ability to identify and deal with threats.
75% of SOC practitioners say AI has reduced their workload in the past 12 months and 73% say AI has reduced feelings of burnout in the past 12 months. 89% plan to use more AI-powered tools over the next year to replace legacy threat detection and response.
“It’s promising to see that confidence is growing among security practitioners; however, it’s clear they are becoming increasingly frustrated with their current threat detection tools which, due to a lack of integrated attack signal, often create additional work rather than streamline the process. The data suggests that the tools being used for threat detection and response, along with the vendors who sell them, aren’t holding up their end of the deal,” Mark Wojtasiak, VP of research and strategy at Vectra AI.
“Teams believe AI delivers an attack signal that will help them identify and prioritize threats, accelerate response times, and reduce alert fatigue, however, trust needs to be rebuilt. AI-powered offerings are proving to have a positive impact, but to truly reestablish trust, vendors will need to show how they add value beyond just the technologies they sell,” cocncluded Wojtasiak.
Source: https://www.helpnetsecurity.com/2024/10/07/soc-teams-security-tools-problems