The Defenders’ Dilemma – A conversation with SANS on the spiral of more by Mark Wojtasiak

This report summarizes a discussion between Vectra AI’s Kevin Kennedy and LimaCharlie/SANS’s Matt Bromiley on the systemic issues driving SOC alert fatigue, including excessive low-value alerts, misaligned vendor incentives, and lack of consideration for false positives in evaluations. They advocate shifting from volume-based alerting to integrated, accurate attack signal intelligence; using red-team exercises tied to organizational threat models to validate tool efficacy; and re-framing SOC performance around time saved and effective response rather than ticket counts. The conversation urges leaders to consolidate signal sources over time, hold vendors accountable, solicit and act on analyst feedback, and create space for analyst creativity to improve detection and response outcomes.