Research by AI extended detection and response company Vectra has revealed growing distrust for threat detection tools as security operation centre (SOC) teams struggle to identify real attacks.
The research was contained in a report titled 2024 State of Threat Detection and Response Research Report: The Defenders’ Dilemma that was released this week. Among other things, it revealed that 48% of SOC practitioners in the Asia Pacific region say security vendors flood them with pointless alerts to avoid responsibility for a breach, and 31% say they do not trust their tools to work the way they need them to work.
They cite a growing distrust in vendors, believing their tools can be more of a hindrance than help in spotting real attacks. This is at odds with growing confidence in their teams’ abilities and a sense of optimism around the promise of artificial intelligence.
The hybrid attack landscape continues to expand as organisations increasingly turn to generative AI-powered tools to streamline processes and enhance their work. This creates more opportunities for attackers and challenges for security teams who are already struggling with security alert noise and false positives. Even though SOC teams are more confident in their defences than they were a year ago, many feel they do not have the right tools to help them effectively detect and prioritise real threats.
Based on a global survey of 2,000 security professionals, the report breaks down why this disconnect exists, how current threat detection solutions are falling short, and the role AI plays in improving the process, delivering accurate threat signals and reducing workloads.
SOC Confidence is improving, but many fear legacy tools are holding them back
Security practitioners are increasingly confident in their capabilities but feel they are losing ground when it comes to detecting and prioritising real threats. So, what is the disconnect? Many SOC teams are managing too many tools and still struggle with an overwhelming number of alerts, leading to concerns about missing critical threats. This is driving a lack of confidence and trust in the current threat detection tools practitioners are using, and resulting in practitioners seeking alternative solutions, such as extended detection and response solutions. The study found:
- Nearly two-thirds (69%) of SOC practitioners in the Asia Pacific region worry they will miss a real attack buried in a flood of alerts, and 51% believe they cannot keep pace with the increasing number of security threats.
- Nearly one-third (31%) do not trust their tools to work the way they need them to work, while 49% say the tools they work with actually increase the SOC workload instead of reducing it.
- Across Asia Pacific, 60% of SOC practitioners have more than ten tools in place and 29% have more than 20 tools.
- Around 60% of teams have either recently adopted or are exploring extended detection and response solutions.
Legacy threat detection tools are creating more work for practitioners, resulting in growing vendor distrust and tool dissatisfaction
SOC teams are increasingly frustrated with their current security tools, which are causing more challenges than they solve. Many practitioners find themselves pushing aside critical tasks to manage the overwhelming alert volume they receive, leading to dissatisfaction not only with the tools but also with the vendors providing them. Practitioners also continue to struggle with alert accuracy, with a significant number of alerts going unaddressed due to time constraints and insufficient tool support. While there are signs of improvement in areas like visibility across hybrid environments, the overwhelming volume of alerts remains a significant issue. The study also found:
- Across the Asia Pacific, 51% of SOC practitioners say vendors are selling threat detection tools that create too much noise and too many alerts, while 68% say vendors need to take more responsibility for failing to stop a breach.
- Over four-fifths (81%) spend more than two hours each day digging through/triaging security events.
- Some 41% say their security tools are more of a hindrance than help when it comes to spotting real attacks, noting that realistically, they are only able to deal with 34% of the alerts they receive, while they would classify 11% of them as real attacks.
- Over half (54%) of SOC practitioners say a lot of their security tools are bought as a box-ticking exercise for compliance.
Adoption and trust in AI for threat detection is growing, but vendors have work to do
SOCs are increasingly adopting AI to improve threat detection and response, driven by a growing trust in AI’s capabilities. While many practitioners are optimistic about AI’s potential to deliver threat signal efficacy to accurately identify and respond to threats, reduce workloads and replace legacy tools, there are still concerns about adding complexity to an already overwhelmed system.
Despite the challenges, there is a strong intent to invest more in AI-powered solutions to enhance efficiency and efficacy. However, for AI to truly gain widespread acceptance, vendors must work to rebuild trust by delivering tools that add real value without increasing the burden on SOC teams. The study found:
- Over three-quarters (77%) of SOC practitioners in the region say their level of investment and use of AI has increased in the last year, with 64% noting that AI has positively impacted their ability to identify and deal with threats.
- Nearly 70% say AI has reduced their workload in the past 12 months, while 66% say AI has reduced feelings of burnout in the past 12 months.
- A large majority (89%) plan to use more AI-powered tools over the next year to replace legacy threat detection and response.
“It’s promising to see that confidence is growing among security practitioners,” said Vectra AI’s Mark Wojtasiak. “However, it’s clear they are becoming increasingly frustrated with their current threat detection tools which, due to a lack of integrated attack signal, often create additional work rather than streamline the process.”
“The data suggests that the tools being used for threat detection and response, along with the vendors who sell them, aren’t holding up their end of the deal,” he added. “Teams believe AI delivers an attack signal that will help them identify and prioritise threats, accelerate response times, and reduce alert fatigue. However, trust needs to be rebuilt. AI-powered offerings are proving to have a positive impact, but to truly reestablish trust, vendors will need to show how they add value beyond just the technologies they sell.”
“While APAC cybersecurity practitioners are more confident in their cyber defence, they are still overwhelmed by cyberattacks despite having enough SOC analysts on their team,” said Vectra AI’s Sharat Nautiyal. “This is largely due to legacy security tools often creating more issues than they resolve, forcing practitioners to sideline critical tasks to manage the excessive alert volume. These outdated tools tend to generate a flood of noise with little return on investment. It’s like turning up to an F1 race with a first-generation racing car and expecting it to perform.”
“However, there is a silver lining: confidence in AI is growing as it reduces workload and burnout, with 89% of respondents planning to use more AI tools next year to simplify and eliminate legacy tools, channelling security investments where they will yield the best results,” he added. “As the market saturates with tools claiming ‘AI’ capabilities, practitioners need to identify which solutions truly cut through the noise and add real value. Effective AI solutions should integrate across all hybrid attack surfaces, helping to identify and prioritise threats, accelerate response times, and reduce alert fatigue.”
You can read the full report here.
