# How many security alerts per day is normal?

There is no normal number; what matters is whether your team can read every alert that reaches a person and act on the ones that matter. A tool that sends hundreds of alerts a day to a small team is not more secure, just less read. A useful way to think about it: an alert that reaches a person should, often enough, lead to an action or a decision. If almost none do, the tool needs tuning or the alert level is wrong. If an alert type is always harmless in your network, mark it so, or decide it belongs in a log rather than in someone's inbox. Expect more alerts in the first weeks, while the tool learns your network and you mark normal activity, and fewer later. Measure your own week: alerts received, alerts read, actions taken. NetSenX does not promise a number of alerts; it explains each one so that reading it takes minutes.

FAQ: [Budget, staff and alert noise](https://netsenx.com/en/faq/budget) · https://netsenx.com/en/faq/how-many-security-alerts-per-day-is-normal

## Read next

- https://netsenx.com/en/pricing
- https://netsenx.com/en/ndr-for-small-business

## Related questions

- [What should every security alert include?](https://netsenx.com/en/faq/what-should-every-security-alert-include)
- [What is a realistic false-positive rate for NDR?](https://netsenx.com/en/faq/what-is-a-realistic-false-positive-rate)
- [We get too many false positives. How do we tune without missing real attacks?](https://netsenx.com/en/faq/how-to-tune-false-positives-without-missing-real-attacks)
- [How long until a new security tool stops being noisy?](https://netsenx.com/en/faq/how-long-until-a-new-security-tool-is-quiet)
- [How much time does a small team need to run NDR?](https://netsenx.com/en/faq/how-much-time-does-a-small-team-need-to-run-ndr)