Agree. The F100s I contract with are easily pushing billions if not trillions.
Many of them have tried the LLM triage/SOC Analyst to…varying success.
One opened a legit P2 a few days ago actually. Great work right? Upon closer inspection it had decided this activity was a false positive for a solid month before.
The compromise (not significant in the end) was well done and over with by that point.
Others are swamped in so many FPs being bubbled up as true positives that they essentially just ignore it.
Many of them have tried the LLM triage/SOC Analyst to…varying success.
One opened a legit P2 a few days ago actually. Great work right? Upon closer inspection it had decided this activity was a false positive for a solid month before.
The compromise (not significant in the end) was well done and over with by that point.
Others are swamped in so many FPs being bubbled up as true positives that they essentially just ignore it.