False Positive Fatigue: When Alert Volume Becomes Your Problem

Sometimes, it's much worse.

When analysts repeatedly investigate alerts that turn out to be benign, something important starts happening:

attention becomes the scarce resource.

This is where false-positive fatigue becomes a detection-engineering problem — not just an analyst problem.

Imagine a rule generating 1,000 alerts:

• 950 benign
• 50 potentially interesting

The detection technically works.

But the signal is buried under noise.

That creates a dangerous feedback loop:

More noise → less attention → slower investigation → greater chance of missing the real signal.

This is why I don't evaluate a detection purely by asking:

"Did it fire?"

I also ask:

"Did it fire for the right reasons?"

Tuning isn't about making alert counts look smaller.

It's about increasing the proportion of alerts that deserve an analyst's attention.

Sometimes that means adding context.

Sometimes it's exclusions.

Sometimes the better answer is changing the detection logic completely.

A quiet detection isn't necessarily a good detection.

But a detection that consistently produces useful, actionable signal is much closer to one.