I love the phrase “human in command”. We use it a lot at CloudGuard, and I mean every word of it. But there’s something the security industry rarely says out loud: putting humans in command is a double-edged sword.
Humans are brilliant. Humans also get tired. SOC alert fatigue is what happens when the second fact meets an endless queue.
Benign. Benign. Benign. Swipe.
A traditional SOC analyst’s day is typically a queue of alerts, worked one after another, day after day. 73% of organisations now name false positives as their number one detection challenge, and the share seeing them “very frequently” rose from 13% to 20% in a single year (SANS 2025 Detection & Response Survey).
After a while, the work starts to feel like a dating app (or worse). Benign. Swipe. Benign. Swipe.
After dismissing forty false alarms before lunch, even the best analyst starts to expect the forty-first to be another one. And that’s exactly when a real threat slips through.
This isn’t a criticism of analysts. It’s a criticism of the job the industry has created.
SOC alert fatigue is a security risk, not a wellbeing footnote
Alert fatigue tends to be discussed as a people problem: burnout, retention, morale. All of that is real. But the bigger issue is what fatigue does to judgement.
The chain is simple. Tiredness leads to shortcuts. Shortcuts lead to bad judgement. Bad judgement leads to exposure.
Under pressure and at scale, people fail in predictable ways. They skim. They stop at the first plausible explanation.
They follow the playbook until there’s just enough evidence to make a call, and miss the lateral movement two hops away. In the UK, three in four IT teams suffered outages in 2025 because critical alerts were missed (Splunk).
Then there’s the water-cooler moment. An analyst steps away for a coffee or a comfort break. That’s human, and it should be. But attackers don’t wait for the kettle to boil.
Exploiting vulnerabilities is now the most common way attackers get in, overtaking stolen credentials for the first time, while the median time to fully fix a known-exploited vulnerability has grown to 43 days (Verizon 2026 Data Breach Investigations Report). For weeks at a time, the alert queue is often the last line of defence.
A tired human, a long queue and a fast attacker, in the agentic AI era, are a lethal combination.
The work nobody wants, done every time
ANSEL, our agentic AI guardian, takes on the work behind SOC alert fatigue: the work humans don’t enjoy but that still has to be done.. It doesn’t need breaks. It doesn’t get sick. It doesn’t have a Friday afternoon.
Essentially, ANSEL triages every incident the way a good analyst would on their best day.
It gathers the history, forms a hypothesis, writes and runs its own queries across the customer’s estate, and checks the surrounding context every time, not just until it has enough to make a call. When it can show an incident is benign, it closes it.
When it can’t, or something looks wrong, it escalates to one of our analysts with the full working: the queries it ran, what came back, how it read the evidence, and where it’s uncertain. The best thing here, it learns from the benign cases and further tunes the detection rules, more on tuning in a later article.
Then our analysts check ANSEL’s work too, reviewing random batches of its closures across customers and severities. ANSEL also has it’s own dedicated QA agents that also help our human SOC analysts review its own work.
The result is that investigative legwork that once took an analyst hours now arrives in seconds, already assembled. I’ll break down exactly where that time goes in a future piece.
Where the human in command comes in
We’re deliberate about being clear where the AI works and where our people work, because too few in this industry are.
The AI handles volume and speed. It triages, investigates, and closes what it can prove is benign or duplicated. These are what we call deterministic playbooks. Our analysts handle judgement and critical thinking. They review what’s escalated, make the decisions, and own anything that would change a customer’s environment.
That’s what human in command should mean.
It isn’t a person staring at a queue until their eyes glaze over. It’s a person who arrives fresh to the alerts that matter, with the evidence and decision reasoning already in front of them.
What analysts do with the time back
“ANSEL is phenomenal at dealing with low level incidents from triage, investigation, all the way through to completion all by itself. On higher complexity tickets, it provides invaluable insight and analysis which saves the SOC team precious minutes and even hours during incident response.” Niall McHugh, SOC Analyst, CloudGuard.
Here’s the part I enjoy most. When you take the ‘swipe-right’ work away, analysts get to do the work they came into security for.
They spend more time on threat intelligence. They build proactive threat models for customers with more advanced risks. They dig into emerging and industry-specific threats and explore the landscape on a customer’s behalf before an attack reaches them.
“The most important factor in choosing CloudGuard was finding a provider I was totally confident would be able to view and analyse our security logs and data. CloudGuard have demonstrated that they are more than capable of managing a very large set of logs from disparate providers, and of effectively providing our company with the information we actually need to act upon. In the past we have received a lot of alerts; with Cloudguard we only receive what is important to the team and business which cuts the noise.” From a Cloudguard customer in the international luxury retail sector.
I hear versions of the above from our team and our customers every day. It’s also good for the organisations we protect. UK organisations that make extensive use of security AI and automation saved £1.59 million per breach on average (IBM Cost of a Data Breach Report 2026, UK edition).
Trusting the machine
Handing work to an AI raises a fair question: how do you know you can trust it? The answer lies in governance, guardrails, and holding AI agents to the same standards of accountability as the people they work alongside. That’s a chapter of its own, and we’ll get to it soon, along with a closer look at a day in the life of a SOC analyst, with and without ANSEL.
For now, the threat landscape isn’t waiting for anyone. In October, AI-assisted research uncovered critical flaws in PHP, the language behind much of the web, affecting every version released in the last decade. The patch arrived on 21 October, and within days the flaws were being actively exploited. AI is finding vulnerabilities faster than ever, and attackers are using the same tools to weaponise them just as quickly.
When both sides move at machine speed, a tired analyst working through a queue is the weakest link, and SOC alert fatigue is the gap attackers walk through
Human in command only works if the human is fresh enough to command.
