Episode 23: How agentic AI reduces alert fatigue for MSP security teams

Christina

Okay, so if you're running an MSP, a managed security service provider, or maybe you rely on one, you know you're up against it right now. The threat landscape. It's just it's scaling way faster than humans can keep up. And you asked us to really um dig into this operational mess-facing security pros, and maybe more importantly, what new tech is actually offering a way out.

Adam

Yeah, it's this impossible squeeze we keep hearing about. I mean, the sources we looked at, they paint this picture right. Massive threats, automated threats evolving super fast. And they're just slamming into, well, limited human capacity and frankly, old tech, the traditional security model. It's just it's broken fundamentally.

Christina

Right. And the proof is, well, it's in those stats you shared earlier. We're dealing with tool sprawl analysts get whiplash from that. Then there's alert overload, which, you know, just guarantees burnout, and the constant, really debilitating cybersecurity talent shortage. But the most shocking thing I think from the sources was this traditional models just can't scale. And security teams, get this, they might ignore up to 62% of all alerts just because of the sheer volume, lack of capacity.

Adam

That 62% figure. Wow, that's really the bedrock for this deep dyes, isn't it? Because when you realize that almost two-thirds of alerts might be getting dropped, you see the problem isn't visibility, not really. It's a crippling lack of capacity to act on what they already see. So our mission here is to unpack how this thing called agentic AI tackles that crisis head on. We're looking at operational efficiency, the results, the quality of service, and uh what happens to the human analyst in all this.

Christina

Okay, let's unpack that operational squeeze first. For an MSP, I mean you're protecting dozens, maybe hundreds of clients all at once. The burden really starts with everything being so fragmented. We call it tool sprawl, but it sounds like it's way more than just an annoyance.

Adam

Oh, it's a systemic barrier. Absolutely, frankly. Your average security operations center, the SOC, they're forced to juggle, what, multiple platforms, endpoint, network, logs, threat intel. And the sources really highlight how these tools often operate in silos. It's a legacy vendor thing mostly. But the real kicker, the insight here, is analysts spending more time switching consoles, logging in again, staring at different dashboards.

Christina

And actually investigating. Right. I get that. It's not just slow, it sounds demoralized.

Adam

Exactly. It is demoralized.

Christina

We've all heard the stories, haven't we? Analysts with like three monitors open, trying to manually piece together events from different systems, soul crushing stuff. And that manual effort, it leads straight to the next huge problem: alert fatigue, thousands of alerts a day, and maybe half or more are false positives.

Adam

Precisely. The human brain just isn't wired for that kind of constant high alert state when most of it is noise. It guarantees burnout, it guarantees delayed responses, and it makes it more likely, ironically, that a real subtle threat gets missed. Simply because the analyst is too worn down, too desensitized to see the signal through the noise.

Christina

, which brings us right to the staffing crisis. Analysts burn out, they leave. Training new ones takes months, costs a fortune, and they're not even productive right away. So MSPs are stuck, right? They can't just hire their way out of this can't scale headcount with the threat volume. But without more people, they drown in alerts.

Adam

It's a vicious cycle, and it basically means the traditional human-heavy models, they've hit a hard ceiling on scalability. The only way forward really involves shifting that workload intelligently.

Christina

Okay, so the answer isn't just more automation in general. It has to be smarter, targeted, which takes us right to defining the solution. Agentic AI. What is it exactly? Right.

Adam

The key thing here is the functional difference. Agentic AI. It's AI that does more than just classify patterns or summarize text. It's designed with agency, meaning it performs intelligent actions within defined rules, policy parameters, right, to achieve a specific goal. So it doesn't just predict something might be bad, it acts on it. You can think of it like a virtual tier one analyst, one that works across all your data sources, it understands context, it reasons through possibilities, and it takes initiative following a whole sequence of steps.

Christina

Okay, so let's make that concrete. If traditional machine learning just flags a file saying, hey, this looks suspicious, what does the agenic AI do that's different?

Adam

It adds the reasoning and the action. So traditional ML, it classifies the file, suspicious, okay. Agenic AI takes that flag and immediately correlates it, connects the dots. Did the user who touched that file also log in from, I don't know, a weird location just before? Did that same user suddenly try to escalate their privileges right after accessing the file? If the combined risk score hits a certain threshold, one that you define in policy, the agentic AI can automatically trigger a response playbook.

Christina

Like what?

Adam

Like isolating that endpoint from the network or blocking the user's credentials instantly within seconds. It connects all those docs automatically and acts consistently based on policy every single time.

Christina

All right. So for the ops manager listening right now, maybe pulling their hair out, what's the first big improvement they're going to see? Where does this AI make the biggest dent first?

Adam

Well, it hits hardest initially by tackling that tool sprawl problem head on. Through unification, these modern platforms built for a gentic AI, often called OpenXDR, they basically unify functions that used to be totally separate. They combine things like next gen SIEM, network detection and response, NDR, endpoint detection, EDR, all into one place, one console.

Christina

Hold on, let's quickly clarify that Alphabet Soup, SIEM is mostly log management, right? What exactly does NDR network detection and response bring to the table in this unified setup?

Adam

That's a great question. So NDR is all about watching the actual network traffic, looking for weird behavior, malicious patterns on the wire. Historically, yeah, the logs from SIEM and the network traffic from NDR. Completely separate worlds. Siloed. Analysts had to literally jump between screens, trying to mentally connect a log event with some network flow they saw somewhere else. By bringing them together in OpenXDR, the Eugenica AI can see both things simultaneously. It sees the suspicious login event and the weird network traffic associated with it all in the same analysis, instantly.

Christina

Ah, okay. So that unification changes the game entirely. We go from getting, you know, thousands of separate alerts to getting what the sources are calling case narratives. That sounds different.

Adam

It is different. This is the big cognitive shift, I think. Instead of maybe 50 individual alerts pinging away suspicious login here, PowerShell command there, weird network traffic over there. The agentic AI correlates all of that. All these seemingly separate events, it weaves them into a single comprehensive case file. The insight here really is that you're moving away from just raw data analysis towards story consumption. The AI does the heavy lifting. It writes the first draft of the story, essentially. It leaves the human analyst with the critical job. unknown 6:47 Yeah.

Adam

Editor, reviewer, final decision maker, not drowning in raw alerts.

Christina

So the case narrative isn't just the raw facts listed out, it gives the human analyst everything they need to make the call.

Adam

Absolutely. Yeah. Every case file includes like a visual threat graph. You can actually see the attack chain. It has an AI written summary, plain English, explaining what happened, a precise timeline of events, and crucially a clear verdict recommendation. We think this is malicious because XYZ, based on objective risk scoring, it totally changes the analyst's day. It moves from low-level, tedious detective work to a much more efficient review and authorization process, high value work.

Christina

Okay, we have a perfect, really concrete example of this efficiency in the sources. Phishing triage automation. Every MSB deals with this constantly, right?

Adam

Yeah.

Christina

User-reported phishing emails.

Adam

Oh, yeah. Tons of them. And that routine analysis. Checking the sender reputation, scanning attachments, analyzing all the links inside, checking against threat intel feeds. That used to take a human analyst anywhere from, say, 15 minutes to maybe 30 minutes.

Christina

Wow.

Adam

Per email.

Christina

Wow, okay.

Adam

A genic AI. It does that entire complex triage process in under five minutes. And mostly without any human needing to touch it, unless something is really ambiguous.

Christina

Under five minutes. That's that's a huge time saving. But I have to ask this skeptical question here. If we're letting AI do this detailed triage and maybe even initiate a response that quickly, how do we stop the inevitable false positive from, I don't know, shutting down a critical business service by mistake? Aren't we trading speed for potentially massive risk?

Adam

That's probably the most critical question in deployment. And the answer really comes down to two things: policy and transparency. Agenic AI always operates within guardrails. Bounds that are defined by pre-approved policy-driven playbooks. The human analyst or the security leadership sets the rules up front. They define what constitutes an acceptable automatic action. So if an alert comes in, it has a really high confidence score, it clearly matches a known bad pattern and it falls within that pre-approved policy.

Christina

Then the AI acts instantly.

Adam

Exactly. But if the confidence score is lower or it's ambiguous or it falls outside the policy for automatic action, it immediately escalates to the human analyst for review. The control always stays with the human policymaker. Always.

Christina

Okay, that makes sense. And for the MSP structure, specifically managing security for potentially hundreds of different clients, how does that work?

Adam

Yeah, this tech has to be built for service providers from the ground up. Multi-tenancy is absolutely non-negotiable. MSPs need to manage everything for all their clients from one central console. But crucially, maintaining strict separation of data between clients, those tenant boundaries are vital. And they need flexible reporting because every client contract might be different. The platforms are designed for that.

Christina

And integration. Because MSPs already have tools, ticketing systems, workflows. They can't just rip and replace everything overnight.

Adam

No, absolutely not. That's why these platforms are typically designed with an API-first architecture. The whole idea is they should slide into the existing tech stack pretty seamlessly. They need to integrate smoothly with the big ticketing systems like ServiceNow, ConnectWise, et cetera, and collaboration tools too, like Slack or Teams. So the automation actually fits into how people already work.

Christina

All right, let's get down to the bottom line then. The results. What are the measurable, quantifiable outcomes MSPs can actually promise their clients when they deploy a genetic AI?

Adam

The benefits are definitely quantitative and they hit the metrics that really matter. MSPs using this are consistently reporting things like up to a 60% reduction in alert noise, just gone, because the AI is doing that initial correlation, deduplication, and triage before a human even sees most of it. And crucially, mean time to detect MTTD and mean time to respond to MTTR both drop dramatically.

Christina

How dramatically?

Adam

We're talking about automated playbooks, kicking off containment actions, often within minutes, sometimes before a human analyst has even finished reading the AI-generated case narrative. Minutes, not hours or days.

Christina

That kind of speed has got to translate directly into better business outcomes for the client and probably better morale for the security team, too.

Adam

Absolutely. It's a dual benefit, really. First, you get scalability. The MSP can actually handle growth in client numbers or alert volume without needing to hire analysts at the same rate. That breaks the old model. Second, yeah, huge impact on analyst burnout. The sources mention analysts were spending maybe 60 to 70% of their day just on that initial alert, sifting, chasing false positives.

Christina

Wow, 60 to 70 percent.

Adam

Yeah. Now that highly skilled and expensive talent, they get redirected. They can focus on proactive threat hunting, strategic security improvements for clients, handling the truly complex incidents that need human ingenuity.

Christina

And redirecting that talent doesn't just help retention. I imagine it elevates the whole service offering too, right? Makes it more valuable.

Adam

Definitely. It helps shift security from just being seen as a necessary cost center towards being a measurable service differentiator, a competitive advantage. Think about it. An MSP walks into a quarterly review of the client. They can show a visual graph, an AI written narrative proving exactly how a sophisticated attack was spotted and stopped in, say, three minutes flat. That's powerful justification for the security investment. You're not just selling protection, you're selling demonstrated rapid response. Peace of mind backed by data.

Christina

Okay, we touched on this earlier, but let's circle back to the control aspect because it's so important. For listeners who might be wary of, you know, AI taking over, how do we guarantee the human analyst is still the ultimate decision maker?

Adam

Yeah, it's crucial. The concept is pretty simple. Keep the human in the loop. Always. The best analogy is probably autopilot on an airplane. Pilots trust the autopilot completely for routine cruising, handling repetitive tasks accurately and tirelessly. But they always have the authority. They can monitor everything, they can adjust settings, they can override it instantly, and take manual control whenever needed. Same principle here.

Christina

And how is that control made transparent? How does the analyst know why the AI did something?

Adam

Transparency is absolutely non-negotiable for trust and accountability. Every single action the agentic AI takes, it's logged, timestamped, traceable right back to the specific policy playbook that authorized it. So the analyst or an auditor can see not just what happened, but precisely why the AI made that decision. It was based on this risk score combined with these factors, which match this pre-approved policy set by the organization. That's essential for compliance, for policy enforcement, and just for building confidence in the system.

Christina

This really sounds like a significant step, maybe a milestone in a much bigger evolution towards more automated security overall.

Adam

I think it is. Oh, absolutely. It has to. Yeah. These systems are designed to automatically map detected activities and threats to established frameworks, things like the MITRE ATT&CK framework, NIST cybersecurity standards. So when something is detected, it's immediately classified using language and categories security teams already understand. That's vital for reporting, compliance, and just operational rigor.

Christina

Right. And often this combination, the open XDR visibility plus the agentic AI, it's packaged up, like we saw with enhanced.io's model. It comes with a partner-first approach, ensuring the MSPs using the tech also get backed by 24/7 human expert support alongside the automation. Truly human-augmented.

Adam

Exactly. It's that necessary bridge, I think, to achieving sustainable scalability and security operations.

Christina

Okay, so if we pull this all together, synthesizing what we've dug into, agentic AI looks like much more than just another tech upgrade. It's shaping up to be a real competitive differentiator, maybe the only operational efficiency tool right now that enables sustainable growth for MSPs, letting them automate defense against attackers who are themselves increasingly automated.

Adam

And building on that, if agentic AI really can reliably take over, say, 60 to 70% of an analyst's former workload, all that time previously sunk into tedious initial triage, well, that fundamentally reshapes the human analyst's job description, doesn't it? Which leads to, I think, a really important question for you, the listener, to consider. What fundamental new responsibilities, what new skills must human security analysts urgently master now? Now that their focus is shifting almost entirely away from triage and towards strategic threat hunting, client risk consultancy, and those complex high-stakes judgment calls.

Christina

That shift in focus. Yeah, it demands a completely new skill set, something to definitely think about. Thank you for joining us as we explored this really urgent transition towards human augmented security operations. We'll see you next time.