AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Comprehensive Survey

Computer Science > Cryptography and Security [Submitted on 8 May 2026] AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Comprehensive Survey Samuel Ndichu, Akira Yamada, Tao Ban, Seiichi Ozawa, Takeshi Takahashi, Daisuke Inoue Security alert screening is the downstream task of filtering, prioritizing, correlating, and contextualizing alerts for analyst attention in Security Operations Centers. This survey reviews artificial-intelligence-driven alert screening and alert-fatigue mitigation from 2015 to 2026. We synthesize 119 records, including 87 core studies, into a four-stage workflow taxonomy covering filtering, triage, correlation, and generative augmentation. We find persistent gaps in deployment realism, adversarial robustness, cross-environment validation, and evaluation practice. The survey concludes with a research agenda toward trustworthy Cognitive Security Operations Centers. Comments: 35 pages, 5 figures, 9 tables. Submitted to ACM Computing Surveys. Supplementary material (11 pages) and artifact bundle available as ancillary files Subjects: Cryptography and Security (cs.CR) ACM classes: D.4.6; I.2.0 Cite as: arXiv:2605.08316 [cs.CR]   (or arXiv:2605.08316v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.08316 Focus to learn more Submission history From: S. Ndichu [view email] [v1] Fri, 8 May 2026 14:58:52 UTC (61 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)