Cert In Six Hour Reporting

Somewhere between the SOC floor and the boardroom, security information degrades into decoration. The team works in findings and indicators; the board wants exposure, trend, and dollars. The translation layer is usually a slide deck assembled the night before the risk committee, cherry-picking metrics that are easy to extract rather than metrics that are true: alert counts (meaningless), phishing click rates (noise), patching percentages (stale on arrival).

The metrics that would actually inform a capital-allocation decision — time from detection to verdict, percentage of alerts investigated to conclusion, containment time by asset criticality, false-positive trend by detection — are precisely the ones a human-queue SOC cannot produce honestly, because producing them would document the backlog. Nobody presents a slide that says 'we investigate 40 percent of what we detect'.

This is how boards end up approving eight-figure security budgets on vibes and fear. The fix is not better slide design. It is an operational system where every alert reaches a recorded verdict, so the numbers reported upward are queries against reality rather than curated samples of it.

The average enterprise security stack now counts between forty-five and seventy-five tools. An analyst investigating a single suspicious login touches six of them: the SIEM for the alert, the identity provider for auth history, the EDR console for host state, the cloud console for API activity, the ticketing system for context, and a threat-intel portal for reputation. Each hop costs minutes, a login, and a mental context switch — and each tool speaks its own schema, so the analyst becomes a human ETL pipeline, joining datasets in their head at 2 a.m.

Vendors sell integration as the answer, but a webhook that copies an alert from one queue to another is not integration; it is duplication with extra latency. The join the analyst actually needs — this identity, across these five systems, over the last ninety days, compared against its own baseline — does not exist in any single console. It has to be rebuilt by hand for every investigation, which is why an investigation that should take ten minutes takes four hours.

The strategic cost is worse than the operational one. Because context lives in fragments, every conclusion is provisional. Analysts hedge, escalate, and re-investigate, and CISOs discover during incidents that their seventy tools produce seventy partial stories and no authoritative one.

The global shortfall of security professionals is estimated at around four million people, and the gap widens every year. For enterprises outside the tech-salary tier — hospitals, manufacturers, regional banks, public agencies — the practical reality is that senior detection engineers and experienced responders are effectively unhirable. The job postings stay open for nine months and then get quietly rewritten to junior level.

So the industry props itself up on outsourcing, and the maths of shared-service MDR asserts itself: one provider analyst covers many clients, so the analyst who catches your incident at 4 a.m. has never seen your environment, does not know your naming conventions, and escalates with a generic ticket that your on-call engineer must re-investigate from scratch. You have outsourced the alert, not the understanding.

The uncomfortable strategic conclusion is that any operating model whose scaling unit is 'experienced human' is structurally broken for the next decade. The only inputs that scale are compute and context. The enterprises getting ahead are the ones re-basing their SOC on those inputs and reserving their scarce humans for judgment, governance, and the genuinely novel.

Walk into any enterprise SOC at 9 a.m. and look at the queue. There will be somewhere between four hundred and four thousand alerts that arrived overnight, and a rota of tier-1 analysts expected to clear them before the next wave lands. The mathematics has not worked for years. A mid-size enterprise generates tens of millions of security events a day; even after correlation and suppression, the alert volume that survives is an order of magnitude beyond what a human team can investigate properly. So teams do what any rational actor does under impossible load: they sample. They work the highs, skim the mediums, and let the lows age out.

The uncomfortable truth is that attackers know this. Post-incident reviews keep finding the same pattern — the intrusion was detected, an alert did fire, and it sat unworked in the queue for eleven days because it was a medium riding behind three hundred other mediums. The detection stack did its job. The operating model around it failed. Detection coverage without triage capacity is not coverage at all; it is a compliance artefact that produces evidence of negligence after the breach.

Enterprises have tried to buy their way out with headcount, offshore tiers, and suppression rules. Each fix decays. Headcount churns, offshore tiers escalate anything ambiguous, and every suppression rule is a small bet that the suppressed pattern will never matter. The queue always wins — unless something other than a human works it.

Ninety-plus percent of alerts in a typical enterprise queue are false positives, and every one of them costs the same analyst minutes as a real one. But the deeper damage is psychological: after the four-hundredth benign impossible-travel alert, an analyst's prior flips. The default assumption becomes 'this is noise', and the one alert in a thousand that is real gets pattern-matched into the same dismissal. Alert fatigue is not laziness; it is Bayesian reasoning applied to a broken signal.

So teams tune. Detection engineers spend their weeks adding exceptions — this service account, that IP range, this VP who travels. Each exception fixes today's noise and silently narrows tomorrow's coverage, and nobody re-reviews the pile because there is no time. Tuning debt accumulates exactly like technical debt, invisible until an attacker walks through a hole that was carved out to silence a false positive in 2024.

The root cause is that static rules cannot encode context. Whether a login from Lisbon is suspicious depends entirely on who the identity is and what it usually does. Without a behavioural baseline per identity and per asset, every threshold is wrong for someone — too loud for the traveller, too quiet for the service account that should never leave the building.

The modern enterprise attack surface is not a network edge; it is a directory. Tens of thousands of human identities, and — increasingly — multiples more non-human ones: service accounts, API keys, CI runners, and now AI agents with standing credentials. Attackers noticed years ago that stealing a valid credential beats exploiting a vulnerability: no malware, no exploit signature, just a login that looks almost right. The majority of serious cloud incidents now begin with a compromised identity, not a compromised host.

Almost right is the operative phrase. A stolen credential logs in from a slightly wrong place, at a slightly wrong hour, and touches resources slightly outside its habit. Each signal alone is dismissible — which is exactly why rule-based detection drowns: the rules fire on travellers and contractors all day, and the SOC tunes them down until the real one sails through.

Catching identity abuse requires knowing each identity's normal — its hours, geographies, volumes, and peer group — and evaluating every anomaly against that baseline in context. That is a per-entity statistical problem multiplied by a hundred thousand entities, refreshed continuously. No human team maintains that. It has to be computed.