When a new threat emerges, the obvious response is to add another layer of protection.
A new endpoint threat leads to a new detection tool, a new identity attack brings another monitoring system, while a new SaaS risk adds another source of alerts. Each tool fills a gap and adds another layer of visibility.
The challenge starts when all those layers begin generating alerts at the same time.
In 2025, Kaseya monitored more than 27.6 billion SaaS events, of which almost 98.9% were low severity, but more than 278.9 million were medium- or critical-level alerts. With that much activity, finding the signals that need attention quickly becomes as much an operational challenge as a security one.
As the queue grows, analysts have to filter and prioritize. In the process, a signal that looks minor on its own can be overlooked even though it may become significant when combined with activity from another system.
This is the alert fatigue paradox. Adding more tools can increase what an MSP can see while also making it harder to see what matters.
How tool sprawl happens
No MSP sets out to build a complicated security stack.
A client suffers a phishing incident, so the MSP adds stronger email protection. A ransomware incident leads to another endpoint control, while a new compliance requirement brings another monitoring capability. Moreover, customers arrive with tools already in place, and MSPs have to work around those too.
Over time, the stack grows one reasonable decision at a time.
The problem is that those tools often describe security events differently. One may label an event as high severity while another treats related activity as routine. One may know which user generated an alert, while another has the useful information about the device. Each system can have useful data, but without enough shared context, that data can be hard to connect and act on.
For an MSP, there is another layer to the problem. The stack does not belong to one environment. It repeats across clients, each with different technologies, configurations and alert patterns.
That creates an operation that can look comprehensive on paper while leaving analysts to assemble the bigger picture themselves.
The mechanics of alert fatigue
Alert fatigue isn't burnout, but a rational adaptation to an irrational signal environment. That's what makes it dangerous. Here's how it affects the decisions analysts make:
Analysts develop shortcuts
When an analyst cannot investigate every alert with the same depth, they develop shortcuts. Certain alert types get checked first, familiar patterns receive less scrutiny, some combinations of signals immediately trigger an investigation, while others get pushed down the queue.
Those shortcuts are based on experience
That behavior is rational. Analysts adapt to the environment they have been given, but those shortcuts are built from previous experience. They work best when the next incident looks like the last one.
Novel threats can fall outside the filter
That creates a problem for newer attack patterns. An unusual sequence of events may not trigger the same response because it does not match the patterns an analyst has learned to prioritize.
The cost can compound over time
When analysts spend much of their time sorting low-value signals, the work becomes harder to sustain. Over time, that pressure can contribute to analyst attrition, taking experienced people out of the workflow and with them the knowledge they have built. New analysts then have to learn those patterns again, restarting the cycle of building practical knowledge around what matters.
Misclassification adds another layer of risk
The challenge grows when analysts have to make quick decisions across a large volume of alerts. In conversations with our customers, we've found that manual triage misclassification rates can range from 20% to 30%. In a busy security queue, that means some alerts may be assigned the wrong priority or classification before an analyst has time to fully investigate them. A genuine threat can then receive less attention than it needs while the team spends time on lower-value activity.
Why consolidation alone doesn't fix the problem
The obvious response is to consolidate. If analysts are dealing with alerts from many different systems, putting that information in fewer places can make the workflow easier to manage.
But consolidation mainly solves a location problem. It brings information together, but it does not necessarily tell analysts what that information means or which events deserve attention.
That is where contextualization matters.
Correlation connects related signals. Contextualization explains why those signals matter.
For example, correlation might show that an unusual login, a new SaaS application and suspicious endpoint activity all involve the same user. Contextualization adds the information needed to assess the risk, such as whether that behavior is normal for the user, how important the affected asset is, what is typical in that environment and whether similar activity has happened before.
Without that context, consolidation can make the alert queue easier to navigate without making the underlying decisions much easier. The goal is to bring signals together and give analysts enough context to understand what they are seeing and decide what needs attention.
What a better approach looks like
More alerts do not necessarily give analysts a clearer picture of what is happening. A better approach is to bring the right signals together and add the context needed to understand what deserves attention.
1. AI-Assisted triage
AI-assisted triage changes where the filtering happens. Instead of asking analysts to make sense of raw alerts, the system evaluates signals against the context around them.
That can include:
- Behavioral signals from users, endpoints and applications
- Asset criticality
- Client environment history
- Available threat intelligence
The result is a more informed assessment before an alert reaches the analyst.
2. Fewer, better alerts
The objective is not to eliminate alerts. It is to make the alerts that reach an analyst more useful. The ideal workflow looks like this:
Raw signals → Context → Prioritization → Analyst
Instead of receiving a large queue of alerts that all require investigation, analysts receive fewer signals with relevant context already attached, ranked according to probable impact.
3. What better triage should deliver
A well-implemented approach should produce measurable operational improvements:
| Outcomes | What changes |
| Reduced MTTR | Analysts spend less time establishing context before taking action. |
| Lower misclassification rates | More context improves the initial assessment of an alert. |
| Higher analyst retention | Less repetitive, low-value triage makes the workload more sustainable. |
| Improved detection of novel threats | Connecting signals can surface suspicious behavior that does not match a familiar alert pattern. |
Move the intelligence upstream, so analysts spend less time deciding what an alert means and more time deciding what to do about it.
4. How Kaseya applies it
Kaseya's approach to noise reduction applies this logic across the service delivery workflow. Triage connects with asset context and historical incident data, so the analyst starts with a pre-qualified signal rather than a raw alert.
For an MSP, that matters because the same approach can be applied across client environments without requiring analysts to manually reconstruct the same context each time.
The honest tradeoffs
AI-assisted triage does not remove the underlying complexity.
A system that learns from historical data can inherit the blind spots in that history. If a novel attack does not resemble anything the system has seen before, automation can still miss it.
There is also a data problem. Effective contextualization depends on reliable information about assets, users, environments and previous incidents. If that information is incomplete or inconsistent, the quality of the triage will suffer.
And the human side still matters. Analysts who have spent years building workflows around existing alerts may need time to trust a different way of prioritizing their work. Introducing AI without explaining how its decisions fit into the investigation process can create another layer of friction instead of removing one.
The objective, then, should not be to hand security decisions over to AI. It should be to give analysts better information before they make those decisions.
Find the signal in the noise
The instinct to add another security tool when a new threat appears is understandable. For an MSP, the challenge begins when every new layer adds more signals without improving how those signals come together.
That is when more visibility can start producing more blind spots.
The shift is from asking "How do we process more alerts?" to asking "How do we surface fewer, better ones?"
For MSPs trying to make that shift, the next step is understanding where signal-to-noise reduction can fit into the existing security operation.
Learn how to find the signal in the noise
Author Bio: JV Varma is Vice President Product Management, Security at Kaseya. JV is an executive product leader responsible for scaling complex SaaS portfolios through periods of growth, transformation, and integration.
JV Varma — Product Marketing Manager at Kaseya https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjC5_mcLPOU8Qv8G3zVU6eahHfm8B5kFwy4dgmVzdON9-xaES9wAXTF_-FKCMUPdIAFWYNa9eUS0kGJGaMpNoSCQZ9x0JuischaxgetLYlk7pPlm8ANBn5hF_Mlkc6Sd755pUwdYINvzrd4m22ZhilUlGHHZdxIqDuPvrm_qj51qlnsdQOPhivlmkaAD7s/s1700-e365/jv.png
