SOC Personnel & Workforce: Alert Fatigue Is a Retention Problem

What the queue does to the people in it

The last post in this series split the word "shortage" into four problems and set one aside for later: people leaving. This post picks that thread up. Ask the survey data why security staff quit, and the alert queue keeps turning up in the answer.

The big picture: Alert fatigue usually gets treated as a throughput problem. Too many alerts, too few analysts, so you measure closures per hour and buy something that closes them faster. The people working the queue describe exhaustion, cynicism about the work, and a sense that nothing they do makes a difference. Those are the three dimensions the World Health Organization uses to define burnout, and stress is now the most common reason security professionals give for leaving their jobs.

Why it matters: A throughput problem costs you hours. A retention problem costs you the analyst, the months it takes to replace them, and whatever they knew about your environment that never made it into a runbook. A SOC that only watches the first number can raise its closure rate and lose its best people in the same quarter.

By the numbers:

• 76% of security professionals experienced burnout in the past 12 months, and 81% said their workload grew over that time, in Tines' Voice of Security 2026 survey of more than 1,800 practitioners. Heavy workload was the most cited cause, at 39%.
• 52% of respondents to ISACA's 2026 State of Cybersecurity survey named high work stress as the top reason people leave, up from 47% in 2025. Limited promotion and development came second, at 47%.
• 55% of organizations in the same ISACA survey have trouble keeping qualified people, and 68% of respondents say their role has become more stressful over the past five years.
• 26% of SOC practitioners in the 2026 SANS SOC Survey named meaningful work as the most effective way to retain staff, followed by career progression at 24%. Money ranked fourth, at 14%.
• 44% of security team time goes to tasks that could be automated, by Tines' estimate. That's about three and a half hours of an eight-hour day.
• One-half to two times annual salary is Gallup's conservative range for the cost of replacing one employee. At the BLS median wage for information security analysts, $129,180 in May 2025, that is roughly $65,000 to $258,000 per departure.

What burnout means, and where alert fatigue fits

The WHO defines burnout in ICD-11 as an occupational phenomenon caused by chronic workplace stress that hasn't been successfully managed. It has three parts: exhaustion, growing mental distance from the job (which includes cynicism about it), and reduced professional efficacy. The WHO is explicit that it isn't a medical condition.

Each part has a recognizable SOC version. Exhaustion is the shift that ends with the queue longer than it started. Mental distance is the analyst who has closed the same benign alert four hundred times and stops reading closely on the four hundred and first. Reduced efficacy is a quarter of closed tickets with nothing anyone can point to as a result.

Alert fatigue lives in the middle dimension. When most of what fires turns out to be benign, people learn to expect benign, and the queue reinforces that expectation one alert at a time. That learned distance is how a real detection gets closed along with the noise.

Researchers have described this loop for more than a decade. In 2015, a Kansas State University team spent six months doing anthropological fieldwork inside a corporate SOC and concluded that analyst burnout is a human capital management problem, driven by repeating cycles among human, technical and managerial factors. The team later organized its model around four factors: skills, empowerment, creativity and growth. One finding is easy to skip past. Management's usual coping moves, including career progression, addressed the symptoms and left the cause in place.

A 2026 paper by Thimmaraju and colleagues adds a frame from flow theory. Burnout risk rises when job demands and skills don't match, in either direction. Underskilled analysts get anxious, and overskilled ones get bored. A Tier 1 queue full of repetitive false positives is a dependable way to bore a capable person.

Why throughput metrics miss it

Most SOC measurement counts output. Number of incidents handled has been the top reported SOC metric for ten straight years, cited by 70% of respondents in the SANS SOC Survey, and it is also the metric most often used to set SOC budgets. Mean time to respond, alerts closed per analyst and queue size fill out the rest of a typical dashboard. We covered the limits of time-based metrics in Why MTTD and MTTR Are No Longer the Whole Story.

Under fatigue, those numbers can improve while the team gets worse. Closures speed up because people investigate less. The queue shrinks because someone quietly suppresses a noisy rule. Case notes get shorter. None of that registers as a problem on the dashboard, and some of it looks like progress.

Eric Hulse, our VP of Engineering, made the root-cause version of this argument in The Backwards Promise of Agentic AI for Alert Fatigue. Processing alerts faster doesn't address why the alerts exist, and in his words, "It's actually a design problem." The retention point follows from his. Every badly designed detection lands on a person, many times a day.

What a departure costs

Gallup's range covers the general workforce, and Gallup calls it conservative. Three things push a SOC departure toward the high end.

The vacancy. In the 2026 SANS | GIAC Cybersecurity Workforce Research Report, 55% of senior hires took six months or longer. The remaining analysts absorb the queue in the meantime, which is the same workload that drove the departure.

The ramp. A new analyst learns the tools in weeks. Learning that finance's month-end alerts are normal, or which service account always touches which database, takes far longer. We covered that institutional knowledge in the previous post in this series and in When Outsourcing Becomes a Liability.

The concentration. Fatigue rarely spreads evenly. Analysts who can handle hard cases get handed more of them, and they're the people other employers most want to hire. In early findings from Binalyze's 2026 SOC Experience Report, 68% of 400 CISOs in the US and UK said their most skilled analysts and threat hunters are already overstretched.

Here is the arithmetic for a hypothetical 10-person SOC, using public figures and one stated assumption. Treat it as an illustration. We couldn't find a public benchmark for SOC turnover cost.

That works out to one to four analyst salaries a year. It leaves out what's hardest to price: investigations closed without a real look during the vacancy, and environment knowledge that walked out with the person.

What keeps people

The retention data is unusually consistent. SANS has found meaningful work and career progression at the top of SOC retention methods for three years running, with compensation now fourth. ISACA's reasons for leaving point the same way from the other side, with stress first and limited promotion second. Tines found practitioners rank work-life balance as the biggest reason they stay. The SANS | GIAC workforce report adds that only 24% of organizations offer clearly defined career paths, and unclear progression is now the third-largest retention obstacle, at 31%.

The SANS SOC Survey's summary of a decade of answers is direct: "Organizations still leading with salary increases are solving the wrong problem." Pay still matters, and an underpaid analyst will take a better offer. A raise just doesn't change what the job does to a person every day.

Meaningful work is where alert fatigue does its damage. A queue where most alerts resolve benign is, almost by definition, a queue where most effort produces nothing, and analysts notice. The Kansas State model describes the fix in structural terms: give people the skills, the authority to change what's broken, room for creative work, and growth they can see. Being allowed to fix a noisy rule is a small piece of meaningful work. Closing that same rule by hand for the four hundredth time teaches an analyst that nothing they do changes the queue.

Management attention is the other half. Only 32% of practitioners in the SANS SOC Survey say management pays close attention to SOC hiring and retention, while 59% of cyber leaders believe it does. Among those leaders, 22% say management listens to retention requests without understanding the urgency, and 14% say it doesn't engage with SOC staffing at all. Gallup found the same pattern across industries: 51% of employees who left said no manager or leader had talked with them about their job satisfaction or future in the three months before they quit.

Signals that alert fatigue has become a retention problem

These are the signs worth looking for before they show up in exit interviews. The table is our own working framework, mapped to the WHO's three dimensions.

The first two rows matter most for security. They're where burnout turns into missed detections, because a tired analyst closing a real alert as benign is a retention problem and a breach risk at once.

Where automation helps, and where it adds pressure

Automation is the obvious lever, and the people closest to the problem want it. In the Tines survey, 65% of respondents who frequently experience burnout were very optimistic about AI's effect on their careers, 20 points above the average. ISACA found 35% of teams leaning more on AI or automation to cover skills gaps, a 12-point jump in a year.

The same data shows how it can go wrong. In Binalyze's early findings, 68% of CISOs said AI is generating so much new information that it has increased burnout risk. At RSAC, SANS CEO James Lyne pointed to emerging research on productivity tools that add to burnout through constant context switching. "I rarely talk to teams that aren't running some version of 100%," he said. Every AI verdict is also something a person may need to check, which the SANS SOC Survey flags as a new operational risk.

Whether automation reduces attrition depends on what happens to the time it frees. If recovered hours go to hunting, detection engineering and the investigations people find interesting, automation feeds the top two retention drivers SANS measured. If the hours just raise the closure target, the job stays the same at a faster pace. We made the operational case for reinvesting that time in From Alert Queue to Outcome.

The test for any automation, ours included, is which part of the job it removes. The repetitive first pass is the part people describe as draining, and it's the part worth taking. If what's left for analysts is reviewing machine output all shift, the job hasn't improved much.

What industry experts are saying

Pam Nigro, writing in Security Magazine about ISACA's 2026 findings, argued that "we cannot 'tool' our way out of this." Her case was that the workforce problem is a human one and has to be managed as one.

Christopher Crowley, author of the 2026 SANS SOC Survey, treats the leadership gap as a capability problem. When more than a third of security executives describe management attention to SOC talent as insufficient or absent, he writes, the cost goes beyond turnover. The SOC can't build institutional knowledge or develop junior analysts into senior ones.

Rob T. Lee, SANS chief AI officer and chief of research, described the capacity side when the workforce report came out at RSAC: organizations have people, and those people are too busy running current operations to build the skills they need.

The Kansas State researchers reached a compatible conclusion from inside one SOC in 2015. In their model, burnout comes from cycles running between people, tools and management, which is why a fix aimed at only one of the three rarely holds.

The limits of the argument

Between the lines: Most of these figures are self-reported, and each survey measures burnout differently. Tines asked whether people experienced burnout in the past year, a broader test than the WHO definition. ISACA's retention figure counts organizations that report difficulty keeping staff, and it doesn't measure turnover rates. We couldn't find a public, independent dataset of SOC turnover, so the cost table rests on a general workforce estimate and our own attrition assumption.

Several sources sell something related to the problem. Tines sells workflow automation, Binalyze sells forensic investigation tools, SANS sells training, and ISACA sells certifications. Binalyze's figures are early findings from a report that hadn't been fully published when we read them. The Kansas State study observed one corporate SOC, validated against a second, more than a decade ago. The flow-theory paper analyzed job postings and draws its burnout link from earlier research.

Command Zero has a stake too. We build an AI SOC platform that takes on investigation work, which is the kind of fix this post could be read as recommending. Automation can remove much of what drains people. It can't give anyone a career path, a manager who checks in, or the authority to fix a noisy rule. Those are management decisions.

The bottom line: Alert fatigue is usually budgeted as a throughput problem, and much of what it costs shows up later as attrition. Before the next tooling decision, pull three numbers: the share of alerts that close benign, by rule; how many complex cases your two most experienced analysts handled last quarter; and when anyone last asked those two whether they plan to stay. If you can't answer the third, start there. The next post in this series looks at career pathing when Tier 1 work is automated, and where that growth has to come from.

Terms in this post

Terms defined in Command Zero's glossary are linked below. Terms without a glossary entry yet are defined here.

• SOC (Security Operations Center)
• Alert fatigue
• Alert triage
• False positive
• MTTR
• SOC Tier 1

What is SOC analyst burnout?

SOC analyst burnout is occupational burnout as it shows up in security operations: exhaustion, growing cynicism or distance from the work, and a reduced sense of effectiveness, caused by chronic stress that hasn't been managed. Common drivers include alert volume, false positives, on-call load, and work that rarely produces a visible result.

What is the difference between alert fatigue and burnout?

Alert fatigue is desensitization to alerts caused by high volume and frequent false positives. Burnout is a broader syndrome that also includes exhaustion and reduced effectiveness. Alert fatigue is one of the most common paths to burnout in a SOC, because it wears down attention and makes the work feel pointless.

Why do SOC analysts quit?

In ISACA's 2026 survey, high work stress was the top reason security professionals left their roles, cited by 52%, followed by limited promotion and development opportunities at 47%. SANS finds that meaningful work and career progression are the most effective ways to keep SOC staff.

How much does it cost to replace a SOC analyst?

Gallup estimates that replacing an employee costs between one-half and two times their annual salary. At the US median wage for information security analysts, that is roughly $65,000 to $258,000 per departure, before counting the vacancy period and lost knowledge of the environment.

How can you tell if alert fatigue is driving attrition?

Warning signs include closure times falling while case notes get shorter, rules being suppressed outside detection engineering, complex cases concentrating on a few analysts, rising after-hours pages, unused training time, and exit interviews that cite stress or a lack of career path.

Does automation reduce SOC analyst burnout?

It can, if it removes repetitive first-pass work and the recovered time goes to work such as threat hunting and detection engineering. It can add to burnout if it increases the volume of information analysts must review or simply raises throughput targets.

What retains SOC analysts?

In the 2026 SANS SOC Survey, the most effective retention methods were meaningful work (26%), career progression (24%), training (16%) and compensation (14%). Management attention matters too: only 32% of practitioners say management pays close attention to SOC hiring and retention needs.