Original title: Can Risk-Based Alerting Mitigate Cybersecurity Alert Fatigue?
Rafael Uetz, Philipp Bönninghausen, Louis Hackländer-Jansen, Martin Henze · September 2026
Cybersecurity analysts work in security operations centers to spot real cyberattacks. Unfortunately, their monitoring systems trigger huge numbers of false alarms. This floods analysts and causes alert fatigueWhen analysts see so many alerts, most false, that they start ignoring or missing real threats.. A strategy called risk-based alerting tries to fix this by scoring threats based on accumulated risk instead of treating every flag as an immediate alarm. Although companies use it, nobody had tested it systematically. Researchers stepped in to run a thorough evaluation. They broke the strategy down into five core risk ideas that could be tested separately. Instead of just deciding if an alert passed one set cutoff, they ranked all alerts continuously. They tested these ideas across eight different collections of alert data. They discovered that combining specific risk ideas prioritized threats with high accuracy. This strategy strongly outperformed basic rankings that only rely on an alert's severity level. Overall, it can substantially cut false alarms and reduce analyst fatigue.
A teacher is collecting homework from a large class. If they only mark each paper pass or fail, a tiny mistake gets the same treatment as a completely wrong answer, so the students who need help are invisible. Here, the security alerts are the homework, and the old system was pass/fail. The new approach scores every alert by how dangerous it is, so the most dangerous ones rise to the top instead of getting lost in the pile.
Security analysts are drowning in false alarms, and real attacks get buried. This work shows risk-based alerting can rank the dangerous alerts first, so analysts review fewer false positives and stay focused. It also gives a cheap baseline for comparing fancier AI triage later.
The abstract doesn't say how RBA performs in live SOC deployments or whether the AUROC gains translate directly into less analyst fatigue. It reports ranking quality, not precision, recall, or operational workload. Six of the eight datasets were created or extended by the authors, so generalizability to real production data is not established. The paper also does not compare RBA against LLM-based triage; it only positions RBA as a baseline for such systems.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Can Risk-Based Alerting Mitigate Cybersecurity Alert Fatigue? — Rafael Uetz, Philipp Bönninghausen, Louis Hackländer-Jansen et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.