Internet Noise Contributing to Unnecessary Alert Overload for SOC Teams
Summary: GreyNoise says its sensor network analyzed almost 3 million IP addresses opportunistically scanning the internet over 90 days, with only 10,000 identified as malicious and the majority benign or unknown. The company reports its Community version grew to over 12,000 accounts and more than 1,000 daily active users, and that commercial customers and ARR grew by more than 100% over 12 months, including Airbus, Lumen and the Defense Innovation Unit.
Bottom line: Of nearly 3 million scanning IPs in 90 days, only 10,000 were judged malicious - so the alert queue your analysts work through is mostly background noise, and Hurricane Labs reports cutting triggered alerts by 25% once that noise was filtered out.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026