A needle in a stack of needles: Hunting infostealers with AI

Sophos presented a large-scale SOC study showing a layered alert pipeline (detectors, deduplication/correlation, suppression, and supervised ML prioritization) applied to 11.8 trillion events over two weeks, reducing alerts to 81,573 and enabling the identification and containment of an infostealer infection on a customer endpoint; the report describes the detection techniques, model features, and operational trade-offs used to minimize alert fatigue and surface true threats.