1,340 alerts a week is the same as zero
When every week brings more alerts than a person can read, the honest count of alerts being read is none. Triage is a discipline, not a dashboard.
The median small security team we talk to gets somewhere north of a thousand alerts a week across their tools. They read, on a good week, a few dozen. This is not a staffing failure — it's arithmetic. No human reads a thousand of anything a week.
The uncomfortable math
If your tools produce more alerts than your team can evaluate, you don't have detection — you have a write-only log with a notification problem. The alerts that matter are in there, but so is everything else, and the ratio decides what gets seen.
How teams dig out
- Measure alerts read per human, not alerts generated. The first number is your real coverage. The second is vendor marketing.
- Auto-close aggressively. Known-good patterns — the backup job that trips the same rule every Sunday — should close themselves. Every auto-closed alert buys attention for a real one.
- Correlate before you page. Five medium signals about the same user in ten minutes is one incident, not five tickets. Page on the incident, with the evidence attached.
- Protect the night. If your on-call gets paged twenty times a month after hours, they will start sleeping through pages. Count night-time pages as a cost, because they are one.
This is the entire premise of BlackPing's triage: the machine reads everything, rules out the boring explanations, and a human sees the handful of incidents that survived — with the reasoning shown. The goal isn't fewer alerts. It's that every alert a human sees is worth their time.