Your Alert Volume Is a Budget Decision Dressed as a Security Decision

A detection rule is not finished when it ships. It bills you every time it fires, in minutes taken from whoever is on the queue, and it keeps billing for as long as it stays enabled. Nobody writes that cost down. Rules get added in response to an audit finding, a vendor demo, a near miss, or a new log source arriving, and each addition is argued on its merits in isolation. The total is never argued at all.

Which is how organisations arrive at an alert volume nobody chose. The volume is not a judgement about threat. It is the arithmetic consequence of how many analyst hours were funded, colliding with how many rules were switched on, and the collision resolves itself quietly: the queue grows, the oldest alerts get closed unexamined at shift handover, and the team learns which detections to ignore. That last part is the expensive bit, because the ignoring is undocumented and inconsistent, and it applies to good alerts as readily as bad ones.

The arithmetic nobody writes down

Do it with your own numbers, once, and the shape of the problem stops being contestable.

Take the hours you actually fund for triage. Not headcount, not shift coverage, but hours where a human is available to look at a queue rather than sitting in a meeting, working a project, or writing the quarterly report. Divide by the average handling time for one alert, including the context gathering that happens before anyone can even decide it is nothing. That is your ceiling. If handling averages six minutes and you fund the equivalent of one dedicated triage hour per hour of the day, the ceiling is around ten alerts an hour, and that assumes nothing needs a real investigation.

Now count what fires. Most teams have never counted, because the console shows what arrived today rather than a per-rule cost accounting over ninety days. When you do count, the distribution is almost always the same: a handful of rules produce the overwhelming majority of the volume, and those rules are rarely the ones anyone would defend on a whiteboard.

The gap between what fires and the ceiling is not a security posture. It is an overdraft. It gets paid down by silent non-triage, and the interest is paid during an incident, when the review finds the relevant alert sitting in the queue, opened by nobody.

Every rule has a recurring price

The useful reframe is to treat each detection as a subscription with a monthly cost in analyst minutes, then ask whether the coverage it buys is worth that specific recurring spend.

Alert class	Typical cost per firing	Where the cost actually lands
Impossible travel or geo-anomaly	Low per alert, very high volume	Triage queue, constantly, mostly VPN and mobile roaming
Threat intel IP or domain match	Low per alert, high volume	Triage queue, with almost no enrichment available to close it confidently
Generic script or interpreter execution	Medium, needs process ancestry	Analyst time reconstructing what a build agent legitimately does
Data loss keyword match	High, needs a human to read content	Triage plus a judgement nobody in security is qualified to make alone
Privileged cloud role change	Medium, needs change context	Analyst chasing an engineer for confirmation, often across time zones
Authentication brute force followed by success	High, and worth it	Real investigation, which is what the budget exists for

The last row is the point. Some detections deserve an hour of a skilled person's attention. They only get it if the rows above them are not consuming the day. A rule that fires two hundred times a month for a benign reason is not neutral just because each instance is quick to dismiss. It is a standing charge against the capacity you need for the row that matters. The mechanism by which added coverage produces less detection is set out in more detail in our guide on why adding more alerts makes detection worse.

Why the decision gets dressed as risk

Because the honest sentence is uncomfortable to say out loud. The honest sentence is: we are not funded to look at this class of event, so we are choosing not to generate it. What gets said instead is that the rule might catch something, so it stays on.

That reasoning is not stupid, it is self-protective. The person who disables a detection owns the outcome if the thing it would have caught happens. The person who leaves forty noisy rules running owns nothing in particular, because the failure is diffuse and attributable to under-resourcing rather than to a decision. The incentive structure rewards accumulation, and it rewards it individually while the cost is borne collectively.

The way out is institutional rather than personal. A written tuning standard, approved by someone with authority over the budget, converts an individual's risky judgement into an organisational position. The judgement is identical either way. The exposure of the person making it is not, and that is the only variable that was ever blocking the decision. Doing this without losing sight of real activity requires suppression that is scoped, expiring and recorded, which we cover in our guide to handling false positives without going blind.

There are only three levers

Once the cost is explicit, the options are finite and easy to compare.

1. Buy more triage hours. Honest, expensive, and the only lever most escalation conversations consider. Worth pricing properly, including the recruitment and retention cost of a rota that runs permanently at capacity.
2. Reduce alerts per unit of coverage. Better enrichment, tighter conditions, aggregation into cases rather than events, and rules reviewed against their own firing history. This is engineering work, and it has the best return, because it does not reduce what you can see.
3. Reduce coverage deliberately, and record what you gave up. Legitimate when the alternative is coverage nobody can look at. Unacceptable when it happens by accident in the queue.

Most of the volume problem starts upstream of the rules, in what is being collected and at what fidelity, so the second lever usually begins with the log estate rather than with detection content. Our guide on what to log and what to stop logging is the right place to start if your ingest bill and your alert count have both been climbing for the same reason.

The third lever also covers the sourcing question. If the ceiling is one funded analyst against an estate that runs 24 hours, the realistic comparison is not more rules against fewer rules. It is whether triage capacity is cheaper to build or to buy, and the cost lines on both sides are laid out in our comparison of an in-house SOC against managed detection.

What to do next

Pull ninety days of alert counts grouped by rule, and put the analyst minutes beside each row. Then bring the top ten to whoever owns the security budget, with the ceiling arithmetic on the same page. The conversation you want is not about which alerts are annoying. It is about which coverage you are funded to act on, agreed explicitly, and signed by someone who can also approve headcount if the answer is that the current volume needs more people.

If the arithmetic says the gap cannot be closed by tuning alone, our threat detection and response practice works through the same three levers with you, starting from your own firing history rather than from a rule catalogue.