Boaz Barzel, Field CTO at OX Security, recently conducted research with colleagues at OX Security and discovered that an average organisation had more than half a million alerts at any given time. More astonishing is that 95% to 98% of those alerts are not critical, and in many cases are not even issues that need to be addressed at all.
This deluge has resulted in the alert fatigue issue, which jeopardises the foundations of our digital defence and is firmly entrenched in neuroscience.
Security experts must constantly manage alerts. Veteran security practitioner Matt Johansen of Vulnerable U characterises the experience as follows: "You're generally clicking 'No, this is OK.'" 'No, this is OK' 99 times out of a hundred, and then, 'No, this is not OK.' And then this is going to be a very exciting and unique day."
This creates a perilous scenario in which alerts keep coming, resulting in persistent pressure. According to Johansen, many security teams are understaffed, resulting in situations in which "even big, well-funded organisations" are "stretched really thin for this frontline role.”
Alert overload
As the former director of the Gonda Multidisciplinary Brain Research Centre at Israel's Bar-Ilan University and the Cognitive Neuroscience Laboratory at Harvard Medical School and Massachusetts General Hospital, Professor Moshe Bar is regarded as one of the world's foremost cognitive neuroscientists. According to Bar, alert weariness is especially pernicious since it not only lowers productivity but also radically changes how professionals operate.
"When you limit the amount of resources we have," Bar notes, "it's not that we do less. We actually change the way we do things. … We become less creative. We become … exploitatory, we exploit familiar templates, familiar knowledge, and we resort to easier solutions.”
The science driving this transformation is alarming. When neurones fire frequently during sustained attention activities, they produce what Bar refers to as "metabolic waste." With little recovery time, waste builds and we are unable to effectively clean it. What was the result? Degraded cognitive function and depleted neurotransmitters such as dopamine and serotonin, which regulate our reward systems and "reward" us for various activities, not just at work but in all aspects of our lives.
The path ahead
Alert fatigue poses a serious threat to security efficacy and is not only an operational issue. When security personnel are overburdened, Bar cautions, "you have someone narrow like this, stressed, and opts for the easiest solutions." The individual is different.
Organisations can create more sustainable security operations that safeguard not only their digital assets but also the health and cognitive capacities of individuals who defend them by comprehending the neurological realities of human attention.