The Analyst Feedback Loop

The global shortfall of security professionals is estimated at around four million people, and the gap widens every year. For enterprises outside the tech-salary tier — hospitals, manufacturers, regional banks, public agencies — the practical reality is that senior detection engineers and experienced responders are effectively unhirable. The job postings stay open for nine months and then get quietly rewritten to junior level.

So the industry props itself up on outsourcing, and the maths of shared-service MDR asserts itself: one provider analyst covers many clients, so the analyst who catches your incident at 4 a.m. has never seen your environment, does not know your naming conventions, and escalates with a generic ticket that your on-call engineer must re-investigate from scratch. You have outsourced the alert, not the understanding.

The uncomfortable strategic conclusion is that any operating model whose scaling unit is 'experienced human' is structurally broken for the next decade. The only inputs that scale are compute and context. The enterprises getting ahead are the ones re-basing their SOC on those inputs and reserving their scarce humans for judgment, governance, and the genuinely novel.

Somewhere between the SOC floor and the boardroom, security information degrades into decoration. The team works in findings and indicators; the board wants exposure, trend, and dollars. The translation layer is usually a slide deck assembled the night before the risk committee, cherry-picking metrics that are easy to extract rather than metrics that are true: alert counts (meaningless), phishing click rates (noise), patching percentages (stale on arrival).

The metrics that would actually inform a capital-allocation decision — time from detection to verdict, percentage of alerts investigated to conclusion, containment time by asset criticality, false-positive trend by detection — are precisely the ones a human-queue SOC cannot produce honestly, because producing them would document the backlog. Nobody presents a slide that says 'we investigate 40 percent of what we detect'.

This is how boards end up approving eight-figure security budgets on vibes and fear. The fix is not better slide design. It is an operational system where every alert reaches a recorded verdict, so the numbers reported upward are queries against reality rather than curated samples of it.

Every enterprise has automation it is afraid to turn on. The SOAR playbook that could disable a compromised account runs in 'create a ticket' mode, because the one time it ran for real it locked out a departmental VP during quarter close. The lesson organisations draw — automation is dangerous — is the wrong lesson. The right one is that automation without graduated governance is dangerous.

The change board's questions are legitimate: What exactly will this action touch? What happens if the verdict is wrong? Who approved this scope, and how do we undo it? Most automation platforms answer none of these. They offer a run button and a log, which is why enterprise response automation stalls at sending notifications while actual containment still waits for a human with production access and a change ticket.

Closing the gap requires treating autonomy as something earned per action class, not granted globally: recommend-only until precision is proven, approval gates where blast radius warrants, dry-run previews before anything writes, rollback state recorded for everything reversible, and a kill switch that stops it all instantly. With those primitives, automation stops being a leap of faith and becomes a controlled delegation — which is the only form of delegation an enterprise should accept.

The average tenure of a tier-1 SOC analyst in a large enterprise is under two years, and exit interviews are monotonous in their consistency: the work is repetitive, the false-positive rate is demoralising, and the path to interesting work is blocked by the queue itself. Organisations respond with wellness programmes and retention bonuses, treating an architectural problem as an HR problem. No bonus makes it fulfilling to close the same impossible-travel false positive forty times a week.

The cost compounds quietly. Every departure takes environment-specific knowledge that never made it into a runbook — which service accounts behave strangely at month-end, which subnet the scanner lives on, which VP travels constantly and trips geo-velocity rules. The replacement starts from zero, triages worse for six months, escalates more noise to tier 2, and the seniors who should be hunting spend their days re-answering questions the departed analyst had already answered.

This is the hidden tax of the human-queue model: the institution never accumulates judgment. Knowledge lives in people, people leave, and the SOC's effective experience level stays permanently junior no matter how long the SOC has existed. Any serious fix has to move that judgment into a system that does not resign.

SIEM economics are the quiet scandal of enterprise security budgets. Per-gigabyte pricing means the bill scales with data growth, not with value delivered — and security telemetry grows 30 to 40 percent a year as estates move to cloud. Security leaders now spend real engineering time deciding which logs not to collect, which is a sentence that should alarm every board member: the team charged with seeing everything is financially incentivised to look at less.

The workarounds have become an industry of their own. Routing verbose sources to cold storage, sampling flow logs, dropping DNS queries, keeping ninety days when investigations routinely need a hundred and eighty. Every one of these decisions is invisible until an incident, at which point the responder discovers the exact telemetry needed to scope the breach was filtered out to save four thousand dollars a month. The fine for the breach starts at seven figures.

Meanwhile the SIEM itself does less than buyers assume. It stores, indexes, and alerts. The expensive part — deciding what an alert means — is left to the customer. Enterprises effectively pay a premium tax on raw material and then pay again, in analyst salaries, to refine it.

Ninety-plus percent of alerts in a typical enterprise queue are false positives, and every one of them costs the same analyst minutes as a real one. But the deeper damage is psychological: after the four-hundredth benign impossible-travel alert, an analyst's prior flips. The default assumption becomes 'this is noise', and the one alert in a thousand that is real gets pattern-matched into the same dismissal. Alert fatigue is not laziness; it is Bayesian reasoning applied to a broken signal.

So teams tune. Detection engineers spend their weeks adding exceptions — this service account, that IP range, this VP who travels. Each exception fixes today's noise and silently narrows tomorrow's coverage, and nobody re-reviews the pile because there is no time. Tuning debt accumulates exactly like technical debt, invisible until an attacker walks through a hole that was carved out to silence a false positive in 2024.

The root cause is that static rules cannot encode context. Whether a login from Lisbon is suspicious depends entirely on who the identity is and what it usually does. Without a behavioural baseline per identity and per asset, every threshold is wrong for someone — too loud for the traveller, too quiet for the service account that should never leave the building.