Alert fatigue

What it means

Alert fatigue is what happens when people receive so many warnings that they stop responding to them. Most alerts turn out to be harmless, so people learn to dismiss, mute or filter them. The one that matters then sits unread in the same pile.

The idea that makes it click: an alert is a request for human attention, and attention is limited. Each false alarm spends some of it. Past a point the tool is still running, the dashboards are still green, and nobody is actually looking.

Why it matters

The consequence is a missed real incident. Several well-known breaches have involved alerts that fired and were not acted on. Fatigue also wears out the people reviewing alerts, which raises turnover in security and on-call teams and loses the knowledge they built.

The same pattern hits vulnerability scanners. A report with thousands of unverified findings gets triaged by guesswork or ignored, and the critical one is lost among them. A high false positive rate is the main cause, whether in a SIEM, an EDR console or a scan.

How it shows up

You see it in a security inbox with thousands of unread messages, a chat channel everyone has muted, rules added to ignore noisy sources, and scanner reports sent straight to a folder. In development, a build that fails on low-value warnings teaches engineers to bypass the gate.

To reduce it, tune rules to the cases that need action, give each alert an owner and a response step, group duplicates, review rules that never led to action and retire them, and rank by severity and confidence. Prefer findings backed by proof of exploit. NIST's incident handling guidance discusses how false positives burden analysts. Measure the share of alerts that led to action, not the count.