That Microsoft 365 security alert you dismissed without reading? The Defender notification you snoozed? The suspicious login warning you assumed was a false positive?

Any of those could be an actual attack. And if you’ve trained yourself to ignore alerts, you’ll miss the real thing.

The Alert Fatigue Problem

Security tools generate a lot of noise. I’ve seen Microsoft 365 environments generating dozens of alerts daily, most of which are false positives or low-priority issues. After a while, people stop looking.

This is called alert fatigue, and it’s a genuine security risk. Studies show that when alert volumes are high, response times increase and critical alerts get missed. Attackers know this - they count on their activities getting lost in the noise.

But the solution isn’t to turn off alerting. It’s to manage it properly.

Triaging Your Alerts

Not all alerts are equal. Here’s a framework for deciding what matters:

Critical - Drop everything:

• Confirmed malware detection
• Successful sign-in from impossible location
• Admin account compromise indicators
• Ransomware activity detected
• Data exfiltration alerts

These need immediate attention, regardless of time of day.

High - Review within hours:

• Failed MFA attempts on sensitive accounts
• New device sign-ins for privileged users
• Suspicious email forwarding rules
• Unusual file access patterns
• User reported phishing (confirmed as malicious)

Medium - Review within 24 hours:

• Failed login attempts (below threshold)
• Policy violations (non-critical)
• Phishing simulations clicked
• Unusual but explainable activity

Low - Weekly review:

• Informational alerts
• Compliance status updates
• Policy reminders
• Report summaries

Setting Up Alerts Properly

Most security tools let you configure alert thresholds and priorities. Take time to tune these:

Reduce noise at the source:

In Microsoft 365:

• Security & Compliance Centre > Alerts > Alert policies
• Review each policy - do you need all of them?
• Adjust thresholds (e.g., alert after 10 failed logins, not 3)
• Disable alerts for things you can’t or won’t act on

In Google Workspace:

• Admin console > Security > Alert centre
• Review alert types and recipients
• Configure investigation priority

Direct alerts to the right people:

Critical alerts should go to someone who will act on them. That might be:

• Your IT manager
• Your managed service provider
• An on-call rotation for after hours

Don’t send everything to everyone. That guarantees nobody reads anything.

Use tiered notification:

• Critical: SMS/phone call + email
• High: Email + dashboard
• Medium: Dashboard only
• Low: Weekly summary email

The goal is to create urgency for urgent things while not numbing people with constant notifications.

Building an Alert Review Routine

Alerts need regular attention even when nothing urgent happens:

Daily (5-10 minutes):

• Check for any high-priority alerts
• Quick scan of new medium alerts
• Verify nothing critical was missed overnight

Weekly (30-60 minutes):

• Review all alerts from the week
• Identify patterns or recurring issues
• Check for false positives to tune out
• Review any alerts that weren’t actioned

Monthly:

• Analyse alert trends
• Adjust thresholds and policies
• Review whether you’re catching what matters
• Update runbooks for common alerts

What to Do When an Alert Fires

For common alert types, you should have a documented response:

Suspicious sign-in:

1. Check if user is travelling or using new device legitimately
2. If unexplained, reset password immediately
3. Force sign-out of all sessions
4. Review recent account activity
5. Check for mailbox rules, forwarding changes
6. If compromise confirmed, follow incident response plan

Malware detected:

1. Isolate affected device from network
2. Determine if it was blocked or executed
3. Scan for spread to other devices
4. Investigate how it arrived (email, download, USB)
5. Remediate the infection
6. Review and update defences

Impossible travel:

1. Contact user to verify location
2. If not verified, treat as compromised
3. Reset credentials, review activity
4. Check for persistence mechanisms

Having runbooks means you don’t have to think when alerts fire - you follow the process.

Automating Where Possible

Some alert responses can be automated:

Auto-remediation: Microsoft Defender can be configured to automatically quarantine malware, block suspicious processes, and isolate compromised devices. Enable this for high-confidence detections.

Conditional access: Instead of just alerting on risky sign-ins, block them automatically. Require MFA or block access when risk is elevated.

SOAR (for larger businesses): Security Orchestration, Automation, and Response tools can automate investigation and response workflows. Probably overkill for small businesses, but worth knowing about.

The principle: automate responses to clear-cut situations, alert humans for judgement calls.

Outsourcing Alert Monitoring

If you don’t have capacity to monitor alerts yourself, options exist:

Managed Security Service Provider (MSSP): They monitor your security tools 24/7 and escalate real issues to you. Costs vary, but expect $500-2,000/month for a small business.

MDR (Managed Detection and Response): More hands-on than MSSP - they actively hunt for threats and respond to incidents. Higher cost, deeper capability.

Your IT provider: Many MSPs offer basic security monitoring as part of their service. Ask what’s included.

If security monitoring feels overwhelming and you can’t hire someone, outsourcing is better than ignoring it.

The Culture Piece

Beyond tools and processes, there’s a cultural element:

Don’t punish reporting. If someone reports a suspicious email and it turns out to be legitimate, thank them anyway. You want people reporting, not second-guessing.

Share what you learn. When a genuine alert reveals an attempted attack, share the story (appropriately sanitised). People pay more attention when threats feel real.

Lead by example. If leadership ignores security alerts, staff will too. Make visible that you take alerts seriously.

The Bottom Line

Your security tools are trying to tell you something. Whether that message gets through depends on:

• Having alerts configured sensibly (not too much noise)
• Having someone responsible for reviewing them
• Having documented responses for common scenarios
• Having a culture that takes alerts seriously

One missed alert could be the breach that costs you the business. I’ve seen it happen - attackers active in a network for weeks while alerts sat unread in an inbox.

Don’t be that business.

Check your alerts today. Tune what needs tuning. Build the habit of paying attention.

It might be the most important 10 minutes you spend this week.