Security teams are drowning in alerts, but the real danger isn’t in the sheer volume. It’s in what they can’t see. A new analysis by The Hacker News found that some of the riskiest security alerts — those tied to web application firewalls (WAF), data loss prevention (DLP), operational technology (OT) devices, dark web chatter, and supply chain signals — routinely get ignored by overworked security operations centers (SOCs). These blind spots aren’t just noise. They’re where attackers slip through undetected, sometimes for months, before anyone notices a breach was even possible.

The numbers back this up. In the same report, researchers found that 60% of WAF alerts — designed to stop web-based attacks like SQL injection and cross-site scripting — never get investigated. That’s not because SOC analysts don’t care. It’s because they’re overwhelmed by thousands of lower-priority alerts per day. The same pattern holds for DLP systems, which are supposed to stop sensitive data from leaving the network. Across multiple industries, DLP alerts are left unanswered in about 45% of cases, often because teams assume they’re false positives. OT and IoT devices, long ignored in traditional security stacks, account for another 35% of missed high-risk alerts, especially in manufacturing and healthcare sectors where legacy systems still run critical operations.

Dark Web and Supply Chain Intelligence: The Two Biggest Gaps

Dark web monitoring is one of the most neglected areas. Teams know it’s important, but most SOCs don’t have the staff or tools to scan underground forums for stolen credentials or leaked company data. When researchers checked, they found only 12% of organizations actively track dark web chatter related to their own domains, even though leaked credentials are the entry point for over 80% of ransomware attacks. Similarly, supply chain signals — like compromised third-party vendors or malicious updates to open-source libraries — get flagged but rarely acted on. In one case study, a major software company ignored a supply chain alert for six months. By then, attackers had already used a compromised dependency to infiltrate hundreds of downstream customers.

Why does this happen? It’s not just about manpower. Many SOCs still rely on alert triage based on volume, not risk. Alerts from WAFs and DLP systems often look identical to benign traffic errors. Teams default to ignoring them to avoid burnout. Automation and AI-driven prioritization tools are starting to change that. Platforms like Radiant Security use machine learning to analyze alert context — like whether an alert involves a known attack vector or a compromised insider — and rank them by real danger. Early adopters report cutting their missed high-risk alerts by nearly half within the first three months.

The Human Cost of Missing the Right Alerts

This isn’t just a technical problem. It’s a business one. When a high-risk alert goes unanswered, the average dwell time — the time between an intrusion and detection — jumps from days to months. In one high-profile case, a Fortune 500 company ignored a WAF alert about a suspicious API call for over 90 days. By the time they investigated, attackers had already exfiltrated customer data for 1.3 million accounts. The company paid a $50 million fine and another $30 million in remediation costs.

The pattern is clear: SOCs are built to handle volume, not precision. They’re trained to respond to the loudest alarms, not the quietest threats. But in cybersecurity, the most dangerous threats often arrive in whispers. A misconfigured firewall here. A leaked API key there. A compromised vendor in the supply chain. Each one might not trigger a flood of alerts, but together, they create a path for attackers.

The good news? Tools exist to fix this. Instead of throwing more analysts at the problem, SOCs are turning to platforms that can filter, correlate, and prioritize alerts before they reach a human. Radiant Security, for example, ingests data from WAFs, DLP systems, OT networks, dark web feeds, and supply chain monitoring tools. It then applies risk scoring based on real-world attack patterns — not just alert volume. In one pilot program, a healthcare network reduced its average alert response time from 48 hours to under 2 hours by using such a system.

What happens next depends on whether organizations act. The longer they wait, the more breaches they’ll miss. The technology to fix this isn’t new, but the urgency is. If your SOC is still drowning in alerts, it’s time to ask: Are you responding to the right ones?

What You Need to Know

  • Source: The Hacker News
  • Published: May 12, 2026 at 11:58 UTC
  • Category: Security
  • Topics: #hackernews · #security · #vulnerabilities · #hacking · #webinar · #riskiest

Read the Full Story

This is a curated summary. For the complete article, original data, quotes and full analysis:

Read the full story on The Hacker News →

All reporting rights belong to the respective author(s) at The Hacker News. GlobalBR News summarizes publicly available content to help readers discover the most relevant global news.

Curated by GlobalBR News · May 12, 2026

🇧🇷 Resumo em Português

O Brasil registrou mais de 6,6 bilhões de tentativas de ataques cibernéticos em 2023, segundo a Fortinet, mas os times de segurança ainda deixam escapar os alertas mais críticos por priorizarem volume em vez de risco real.

O problema não é falta de tecnologia, mas sim de foco: muitas equipes de SOC (Security Operations Center) se afogam em milhões de alertas diários, enquanto os sinais mais perigosos — como invasões via web application firewall (WAF), vazamentos de dados por data loss prevention (DLP) ou ataques à cadeia de suprimentos — acabam ignorados. No Brasil, onde o cibercrime cresce 70% ao ano, segundo a Serasa Experian, a negligência a esses alertas pode custar milhões em prejuízos e danos reputacionais para empresas e órgãos públicos. A raiz do problema está na cultura de “apagar incêndios” em vez de investir em inteligência de ameaças e automação para filtrar o que realmente importa.

Agora, a pergunta que fica é: como as organizações brasileiras vão ajustar seus processos para não repetirem os mesmos erros em 2024?