How many security alerts per day is normal?

There is no normal number; what matters is whether your team can read every alert that reaches a person and act on the ones that matter. A tool that sends hundreds of alerts a day to a small team is not more secure, just less read. A useful way to think about it: an alert that reaches a person should, often enough, lead to an action or a decision. If almost none do, the tool needs tuning or the alert level is wrong. If an alert type is always harmless in your network, mark it so, or decide it belongs in a log rather than in someone's inbox. Expect more alerts in the first weeks, while the tool learns your network and you mark normal activity, and fewer later. Measure your own week: alerts received, alerts read, actions taken. NetSenX does not promise a number of alerts; it explains each one so that reading it takes minutes.

← All 25 questions on Budget, staff and alert noiseAll topics