Can SOC Operators Explain their Decisions while Triaging Alarms? A Real-World Study
Buobe IA context · why it matters
SOC operators rely on gut feelings — This may lead to inconsistent decision-making and reduced trust in their judgments.
The study highlights the need for better justification of decisions during alarm triage — Improving this could enhance overall security operations by ensuring more transparent and evidence-based reasoning.
Fique de olho
Future research might focus on developing tools or frameworks that support SOC operators in documenting and justifying their decisions.
Moosmann, J., Pekaric, I., Apruzzese, G., Conference on Detection of Intrusions and Malware & Vulnerability Assessment, 2026 Conference Oneliner: Apparently, the operators of our examined SOC mostly rely on 'gut feelings'.
