Alert fatigue

Too many low-value alerts do not just waste time. They teach people that alerts do not matter.

That is the real cost. After the two hundredth false alarm, closing them becomes reflexive, and the reflex does not pause for the one that was real. It has been a contributing factor in several very large breaches where the alert genuinely fired and was genuinely dismissed. Tuning noisy detections is not tidying up; it is protecting the only thing that makes any of them useful, which is somebody still paying attention.

Checked against the primary source.

More on Detection & SOC