We’ve all heard the pitch: "Just add AI to your SIEM and watch the false positives vanish!"
Vendors are promising that 2026 is the year AI-driven filtering finally solves alert fatigue. But if you actually work in a SOC, you know the math doesn't add up.
Despite the billions being poured into AI filtering, we are heading toward a noise crisis. Here is the breakdown of why the Signal-to-Noise Ratio is about to tank:
1. The Data Gravity Problem AI is getting better, sure. But our data ingestion is growing exponentially. We aren't just logging firewalls anymore; we're logging microservices, cloud telemetry, IoT, and ephemeral containers. Even if AI filters 99% of the noise, the remaining 1% of a 10x larger dataset is still more alerts than you can handle today.
2. The Black Box Anxiety When a regex rule fails, you can fix the syntax. When an AI model decides to suppress an alert because "it looks benign based on historical baselines," how do you trust it?
-
Result: Teams will end up creating "shadow alerts" to double-check the AI, effectively doubling the workload to audit the automation.
3. Attackers Have AI, Too While we use AI to filter noise, attackers are using AI to blend in with that noise. They are generating traffic that perfectly mimics "normal" user behavior patterns to poison the very baselines our AI models rely on.
The Bottom Line: AI isn't a magic eraser; it's just a new layer of complexity. Until we fix the underlying data quality and stop logging junk, 2026 is going to be loud.
Read the full breakdown here:https://motasem-notes.net/why-siem-noise-in-2026-will-be-worse-than-2025-despite-ai-filtering/
Discussion: Are you guys actually seeing AI reduce your ticket queue, or is it just hiding the mess under a rug? Let’s hear it. 👇
0 comments