In cybersecurity, it's easy to feel like your successes don't matter. After all, if things go wrong and a failure happens, that’s a lot more likely to make front-page news. Media coverage of high-profile breaches is growing, even for companies that have invested heavily to build up their security programs. Security breaches are never fun, but they're even less enjoyable when you know that your company could have done something about it.

If you work in Security or Operations, you are surely familiar with the concept of “alert fatigue.” Alert fatigue Syndrome is the feeling of becoming desensitized to alerts, causing you to potentially ignore or minimize risks and harming your capability to respond adequately to potential security threats.

As a security analyst in a growing company, it is often easy to get into the “set it and forget it” mentality. You create one alert after another. Then another. And another. With each alert comes a certain amount of work for an analyst. Analyst time costs money, and some alerts consume more time than others. If most of the alerts result in false positives, a large amount of resources are being spent unnecessarily.

Cyberattacks cost businesses trillions of dollars every year in lost productivity, lost business, and legal penalties. So companies try to solve the problem by signing up for as many WAFs, NIDS, and bolt-on bot bundlers as they think they need. But while these systems can help stop cyberattacks, they also cause another problem: alert overload. Alert overload happens when your security team is inundated with notifications about possible threats to your system.

Snyk can send a number of different types of email notifications. Notifications can be powerful when they enable you to learn about a new vulnerability, license issue, or fix an issue in your projects on the same day we find it. However, these alerts can be noisy if they aren’t configured according to the needs of your teams. That’s why we’ve made Snyk notifications flexible! Let’s take a look at how to make them work for you.

If you haven't heard the gospel of risk-based alerting (RBA) in a SIEM context, by the end of this sermon you'll see why you’ll want it running in your environment yesterday, whether you're an analyst, an engineer, or in leadership.