Security teams face 3,000 alerts a day as AI takes on detection and response

Security teams receive about 3,000 alerts a day but leave 63% unexamined, survey findings show. AI security operations that detect threats and act immediately are emerging as an alternative to systems that keep adding alerts.

In its “Defense in Depth, Rebuilt for Machine Speed” report published on 2026-11-06, Andreessen Horowitz cited Vectra’s 2026 survey on the alert backlog. A separate survey found that 40% of respondents had disabled a detection rule, or considered doing so, because they could not keep up with its output. Another 60% had seen an uninvestigated alert develop into an actual incident.

The report said existing detection depends on rules that people write and maintain. Narrow rules miss new attack variants, while broad ones generate queues that can bury real threats. Evidence can also fail to reach security information and event management systems, or SIEMs, because ingestion and storage costs push teams to discard records they consider noise.

Andreessen Horowitz proposed AI security operations that read events directly from existing security products, combining detection, managed detection and incident response in one service. The system would develop detections and respond while an attack is unfolding. The report argued that defense must match the speed of an intruder operating at machine speed.

The proposed product would read directly from endpoint, identity, email, network and cloud event streams that organizations already pay for, without waiting for records to reach a SIEM. Models would examine behavior rather than known attack signatures, including process chains, login patterns and data movement that depart from a host’s history, then propose detections with an explanation.

Confirmed detections would become rules that the model retires when the relevant activity goes quiet. Response would use existing products’ controls to isolate endpoints, end sessions, block senders or capture host snapshots for forensic analysis. Actions that would take a production system down would require human approval.

The report recommended evaluating response outcomes: time from the first malicious event to containment, the share of incidents contained or alerts addressed without human intervention, and the number of false isolations each month.