TL;DR

SOC teams are buried. Vectra AI's 2026 research put the average team at roughly 2,992 alerts a day, with about 63 percent never addressed. The bottleneck is not detection; it is deciding what is real.
The cost is human. A 2022 Tines survey found 71 percent of SOC analysts feeling burned out, and a 2019 Ponemon study found 65 percent had considered quitting over it. Analysts lose up to a quarter of their time chasing false positives.
Severity is not the same as exploitability. Research from Cyentia and Kenna Security has found that only a small fraction of published vulnerabilities, in the low single digits by percentage, are ever exploited in the wild. Ranking work by CVSS score spends effort on threats that never arrive.
Exposure validation proves which findings an attacker could actually use, enriches your SIEM and SOAR with that evidence, and closes the loop. Piscium Radius does this; in our modeled scenarios it reduces the actionable set by 50 to 70 percent, though real results vary. Piscium is an early-stage platform and that figure is modeled, not a production result.

Ask most SOC leaders what they are short of, and the answer is not data. It is certainty. The tools generate more than anyone can read, and the hard part is separating the alerts that represent a real, usable path for an attacker from the overwhelming majority that do not. This piece is about how exposure validation, the proof half of Continuous Threat Exposure Management, gives a SOC that certainty.

The noise problem is measurable

The scale of the problem is not anecdotal. Vectra AI's 2026 State of Threat Detection research reported an average of about 2,992 alerts per day per team, with roughly 63 percent going unaddressed. When most of what arrives cannot be acted on, the queue stops being a work list and becomes a liability.

The damage lands on people first. In Tines' 2022 Voice of the SOC Analyst survey, 71 percent of analysts reported feeling burned out and 64 percent said they were likely to switch jobs within a year. A 2019 Ponemon study for Devo found 65 percent had considered leaving the profession over burnout. A large part of that time is simply wasted: 2019 Ponemon research has estimated that analysts can lose up to a quarter of their hours, roughly 15 minutes out of every hour, chasing false positives, with many teams reporting false-positive rates above 50 percent.

Every one of those minutes is time not spent on a genuine threat. Alert fatigue is a security gap, not only a morale issue: a buried critical alert is functionally an undetected one.

Severity is not exploitability

The root cause of the noise is that most security tooling ranks findings by theoretical severity, and severity is a poor predictor of danger. Vulnerability scanners score a finding on what it could do in principle, based on a CVE and a version check, not on whether it can be reached and used in your environment.

The gap between the two is enormous. Research by Cyentia and Kenna Security, across several editions of their Prioritization to Prediction work, found that only a small fraction of published vulnerabilities are ever exploited in the wild, on the order of a few percent, and that prioritizing by real exploitation signals is far more efficient than patching down a CVSS-sorted list. Verizon's 2025 Data Breach Investigations Report reinforced where attackers actually go: exploitation of vulnerabilities featured in 20 percent of breaches and rose 34 percent year over year, but credential abuse remained the most common entry point at 22 percent, a route no CVE score captures at all.

The takeaway for a SOC is direct. A queue sorted by severity is sorted by the wrong key. What an analyst needs is not "how bad would this be" but "can an attacker actually do this here, and what does it reach."

What exposure validation adds to the SOC

Exposure validation answers exactly that question, and it fits into the SOC workflow rather than adding another console to watch.

Proof instead of theory. Validation tests whether a finding is exploitable in your environment and returns evidence: the path taken, screenshots, packet captures, an audit trail. A finding either comes back proven or it does not, which collapses a long "investigate" list into a short "confirmed" one.
Enrichment where you already work. That proof is pushed into your SIEM as enriched context on the relevant alerts, and findings are mapped to MITRE ATT&CK, so an analyst sees exploitation evidence next to the alert instead of pivoting across tools to assemble it by hand.
Orchestration and closure. Validated, high-severity findings can trigger SOAR playbooks, and the remediation runs as a closed loop: a ticket with an owner and an SLA, then a re-validation that confirms the fix actually removed the path.

The effect is to move analyst time from triaging maybes to acting on proven exposures.

Where Piscium Radius fits

Piscium Radius is built to drop into an existing SOC stack rather than replace it. The already-published specifics:

SIEM and SOAR integration. Radius integrates natively with Splunk, Microsoft Sentinel, and IBM QRadar, pushing validated findings, attack-path context, and remediation status as enriched events. For response, it works with XSOAR, Splunk SOAR, and ServiceNow Security Operations to trigger playbooks when validated findings cross a severity threshold.
It complements your scanners. Radius ingests findings from tools such as Qualys, Tenable, and Rapid7 and validates which of them are actually exploitable, so your scanners keep finding and Radius decides what is real.
Closed-loop remediation. When a finding is validated as exploitable, Radius creates an enriched ticket, assigns it by asset ownership, tracks SLA compliance, and re-validates after the fix to confirm the exposure is closed.
Measured noise reduction. In our modeled scenarios, exploitability validation reduces the set of actionable findings by 50 to 70 percent, leaving alerts that are confirmed-exploitable and business-context scored. That range is modeled and illustrative; results in a real environment will vary.

For the honest caveats: Piscium is an early-stage company, our figures are modeled rather than production results, and we align our testing to the OWASP Autonomous Penetration Testing Standard (APTS) rather than claiming certifications we have not earned.

Frequently asked questions

Does Piscium replace our SIEM or our vulnerability scanner? No. It complements both. Your scanners keep finding potential issues and your SIEM keeps collecting events; Piscium Radius validates which findings are exploitable and enriches the relevant alerts with that proof. It adds a validation layer, not another silo.

How much can it actually cut our alert volume? In our modeled scenarios, exploitability validation reduces actionable findings by 50 to 70 percent. That is a modeled figure and your environment will differ, but the mechanism is simple: alerts tied to findings that cannot be exploited drop out of the actionable queue.

Can it trigger our response playbooks automatically? Yes. Radius integrates with XSOAR, Splunk SOAR, and ServiceNow Security Operations to launch playbooks when a validated finding meets a severity threshold, so the response starts from proof rather than a raw alert.

How does the closed loop actually work? When a finding is validated as exploitable, Radius opens an enriched ticket, assigns it based on asset ownership, tracks the SLA, and after the fix is marked complete it re-validates to confirm the attack path is gone before closing.

For the framework basics, see What is CTEM?. For the cloud and enterprise view, see CTEM for cloud and enterprise.

Sources

Vectra AI, 2026 State of Threat Detection (alert volume and unaddressed share).
Tines, Voice of the SOC Analyst 2022 and Ponemon Institute / Devo, Effectiveness of the SOC (2019) (burnout and time lost to false positives).
Cyentia Institute / Kenna Security, Prioritization to Prediction (share of vulnerabilities ever exploited); Verizon, 2025 Data Breach Investigations Report.

Want your analysts working proof instead of maybes? Schedule a technical demo to see how Piscium Radius validates exposures and enriches your SIEM and SOAR with exploitation evidence.