Alert fatigue gets discussed as a morale problem. The alert fatigue cost is a budget problem, and it is usually a larger one than the tooling that causes it.
The difficulty is that nobody knows the alert fatigue cost for their own organisation. Triage time doesn’t appear on any invoice — it’s absorbed into salaries that were going to be paid anyway, which makes it feel free. It isn’t; it’s just unbilled.
What follows is a model you can run against your own figures. I’ve used illustrative values to show the shape, but the point is to substitute yours. Don’t quote my numbers — they’re an example, not a benchmark.
The direct cost
The part of the alert fatigue cost you can actually measure takes five inputs. You have all of them, or can get them in an afternoon.
| Input | Where to find it | Example |
|---|---|---|
| Alerts reaching a human per day | SIEM/SOAR queue volume, after auto-close | 250 |
| Median minutes to triage one | Time from assignment to disposition | 12 |
| Analyst fully-loaded hourly cost | Salary + benefits + overhead ÷ working hours | $65 |
| Proportion closed as benign | Disposition field | — |
| Working days per year | 250 |
The arithmetic:
250 alerts × 12 minutes = 50 analyst-hours per day.
50 × $65 = $3,250 per day.
× 250 working days = $812,500 per year.
That is roughly six full-time analysts, spent entirely on triage, before anyone has investigated anything or improved a single detection.
Now apply the disposition rate. If 95% of those alerts close as benign — and if your number is materially better than that, you’re doing unusually well — then about $771,000 of that was spent establishing that nothing happened.
Worth being fair about this: some of that spend is unavoidable and legitimate. Establishing that nothing happened is the job, and a system producing zero false positives is a system that isn’t looking. The question isn’t whether to spend it. It’s whether the ratio is the best you can do.
The costs that don’t appear in that number
The triage figure is the visible part of the alert fatigue cost, and in most organisations it is the smaller problem.
Tuning debt
Teams under alert pressure suppress alerts. This is rational and everyone does it. But each suppression is a permanent, undocumented blind spot, and it compounds — a rule tuned away in 2023 is still off in 2026, and nobody remembers why.
The cost surfaces exactly once, during an incident, when someone discovers the detection that would have caught it was disabled eighteen months earlier for good reasons that no longer apply.
You can approximate this. Count your suppressions and exclusions. Then check how many have a documented rationale and a review date. The gap is your tuning debt.
Attrition
This is usually the largest hidden cost, and it’s the one that most reliably surprises finance.
Triage-heavy work is the most-cited reason analysts leave SOC roles. Replacing one is not just recruitment cost — it’s a vacancy period, onboarding, and the six-to-twelve months before a new hire is as effective as the person who left. Total replacement cost commonly runs well past a year of salary once all of it is counted.
Lose two analysts a year to burnout and that alone may exceed the entire annual cost of the tooling that would have reduced the queue.
The alert that mattered
The hardest to quantify and the reason the others matter.
Every hour a real detection sits in a queue is an hour of attacker dwell time. The relationship between dwell time and incident cost isn’t linear — the difference between catching something during initial access and catching it after lateral movement and staging is the difference between an afternoon’s work and an incident response engagement.
You can’t put a clean number on this. But you can ask a sharper question: how long does a genuine finding sit in your queue before someone opens it? Most teams have never measured it, and the answer is usually worse than expected.
What actually reduces the number
Three things move the alert fatigue cost, and one popular answer doesn’t.
Correlation — the largest available win
Most of the alert fatigue cost isn’t a hundred separate problems. It’s a much smaller number of situations, each generating many alerts.
One intrusion touching six hosts can easily produce forty alerts across your EDR, your SIEM, and whatever else is wired into the SOC queue. Triaged individually that’s forty separate acts of context-gathering, mostly repeated. As one correlated incident it’s one investigation with more evidence than any individual alert carried.
This is where the arithmetic genuinely changes rather than shifts, because it reduces the number of things requiring human attention rather than the time spent on each.
Context at the point of triage
Much of those twelve minutes isn’t judgement. It’s gathering — pivoting to another console for the process tree, checking whether the host is a build server, working out what ran before.
Alerts that arrive with the evidence chain attached compress that substantially. The judgement part is fast; the assembly is what takes the time.
Fewer, better-founded detections
Less popular, and genuinely effective. A rule producing forty false positives a week to catch one true positive a year is negative value, and most estates have several. Auditing rules by their actual disposition history usually finds a handful responsible for a disproportionate share of the queue.
What doesn’t work: more tuning
Tuning is how teams cope, and it’s the mechanism that creates tuning debt. It reduces today’s queue by trading away tomorrow’s coverage, silently — and the coverage you lose is usually behavioural rather than signature-based, because behavioural rules are the noisy ones. It should be a deliberate, documented, reviewed decision — not the default response to a bad week.
Building the case
If you are taking the alert fatigue cost to someone who controls budget, four numbers do most of the work:
- Annual triage cost — alerts × minutes × loaded rate × working days
- Proportion of it spent on benign dispositions
- Analyst turnover in the last two years, and stated reasons
- Median queue time for findings that turned out to be real
The fourth is the one that changes the conversation, because it converts an efficiency argument into a risk argument. A CFO can defer an efficiency argument indefinitely. “Real findings sit unread for nine hours” is harder to file away.
Where we fit
Disclosure: I work on a detection platform, so treat the following accordingly.
Logster is built around the first two levers above. It constructs a behavioural graph from Windows and Linux endpoint telemetry, using Sysmon, auditd and eBPF telemetry. Activity belonging to one situation surfaces as one correlated incident mapped to MITRE ATT&CK rather than as scattered alerts across hosts and tools — and each finding carries the process chain that produced it, so the assembly work that dominates triage time is already done.
What it doesn’t do is eliminate the queue. Nothing does, and a vendor promising it is describing a system that has stopped looking. The honest claim is a better ratio: fewer things needing human attention, and less time spent on each one. There’s more on how it works, and what it costs, if you want to put a real number against the one you just calculated.
Which is why the alert fatigue cost model above is worth running before you talk to anyone, including us. If you know your own number, you can evaluate any claim against it. If you don’t, every vendor’s percentage sounds equally plausible.
Common questions
How do you calculate the cost of alert fatigue?
The direct alert fatigue cost is alerts reaching a human per day, multiplied by median triage minutes, converted to hours, multiplied by an analyst’s fully-loaded hourly cost, then by working days per year. Add attrition and tuning debt separately — they’re usually larger and they don’t appear in any queue metric.
What percentage of security alerts are false positives?
It varies enormously by estate and tooling, so treat any published figure with caution. The number that matters is your own, and you already have it: the disposition field in your ticketing system. Pull the proportion closed as benign over the last quarter. That single query is more useful than any industry average.
How much does it cost to replace a SOC analyst?
More than recruitment fees. Count the vacancy period, onboarding, and the six to twelve months before a replacement matches the effectiveness of the person who left. Fully counted, it commonly exceeds a year of salary — which is why attrition is usually the largest hidden cost of a triage-heavy operation.
Does reducing alert volume mean reducing detection coverage?
It depends entirely on how you reduce it. Suppressing rules reduces volume by removing coverage — that’s tuning debt, and it’s permanent unless someone reviews it. Correlating related alerts into single incidents reduces volume without removing anything, because the underlying detections all still fire; they just arrive as one thing to investigate rather than forty. Only the second is free.
What’s the difference between alert correlation and alert aggregation?
Aggregation groups alerts by shared attributes — same host, same time window, same rule. Correlation establishes that alerts describe the same underlying activity, using relationships like process ancestry and session lineage. Aggregation shrinks the list. Correlation shrinks the number of investigations, which is the number that costs money.
Related reading
- How to evaluate a threat detection platform — twelve questions that separate vendors, including the ones we find uncomfortable
- Sysmon vs auditd vs eBPF — choosing endpoint telemetry sources
- You can’t just paste logs into an LLM — why context selection, not model choice, is the hard part
- How Logster correlates alerts into incidents
All figures in this article are illustrative and chosen to show the structure of the calculation. Your inputs will differ, possibly a lot. If you run it and the result surprises you, I’d be interested to hear which input was furthest from what you expected.