Alert Fatigue Is a Security Metric, Not a Morale Problem
Most orgs respond to alert fatigue with rotation schedules, mental health check-ins, or hiring more analysts. All reasonable, none of them fix the actual problem: a detection pipeline generating more noise than signal, which is a tuning failure, not a staffing shortfall.
Track signal-to-action ratio, not alert volume
Counting total alerts tells you nothing useful — it doesn’t distinguish between 10,000 alerts that each require a decision and 10,000 that are auto-closeable duplicates. The metric that matters is what fraction of alerts result in an actual action (escalation, ticket, remediation) versus a dismiss-and-forget. If that ratio is under 5%, your rules are too broad, and adding headcount just spreads the same noise across more people instead of removing it.
Kill rules before you tune them
The instinct when a rule is noisy is to tighten its thresholds. Often the faster fix is deleting it and confirming nothing important was riding on it — most legacy detection rules were written for an environment that no longer exists, and nobody owns the decision to retire them. Run a 90-day audit of which rules have never once led to a real action, and sunset them explicitly rather than letting them quietly erode trust in the rest of the pipeline.
Separate “needs a human now” from “needs a human eventually”
A huge share of fatigue comes from routing informational alerts through the same channel as ones requiring immediate triage. If a Slack channel or pager gets both “unusual login from a new device, self-resolved” and “ransomware indicator on a production host,” analysts learn to skim everything — including the alert that actually mattered. Split your routing by required response time, not by source system, and the urgent channel becomes trustworthy again.