A security team receives more alerts after adding a new monitoring tool. Explain how it should decide whether the tool is worth keeping.
Answer
The team should assess whether the tool meaningfully improves detection or risk reduction, and compare that value with its costs in staff time, attention, and operational capacity. It should consider whether alerts are useful and whether analysts can interpret them. The presence of more alerts alone does not demonstrate better detection.
Explanation
### The concept
A detection capability is useful when it contributes value that justifies the resources needed to operate it. Those resources include staff attention, time, and operational capacity, not just purchase costs. Analysts should consider whether the tool helps identify events or investigate them and whether its outputs can be interpreted effectively. An increase in alert volume alone does not show that security has improved.
### What a good answer covers
- Compare detection or risk-reduction value with operating demands.
- Include staff time, attention, and operational capacity in the assessment.
- Consider whether the alerts support identification or investigation.
- Avoid treating alert quantity as proof of effectiveness.
### Remember
A useful tool improves decisions, not merely the number of alerts.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free