What an ex-NSA red teamer wants every SOC to stop doing

The New Stack · 3 days ago

Security operations centers are overwhelmed with alerts from multiple data sources, creating alert fatigue that obscures genuine threats amid noise. The webinar on July 23 will feature Chas Clawson, an ex-NSA Red Team member now at Sumo Logic, discussing how to reduce alert volume through better context and data strategy. Teams should shift from individual event-based alerts to entity-centric detections around users and workloads, with AI helping to correlate evidence and surface high-priority signals rather than replacing human analysts.