Cloud Teams Cut Noise: AI Drops 58.5% of High-Severity Alerts Using Context
Research shows most high-severity cloud alerts are downgraded when checked against actual environment context.
Key points
- An AI agent re-graded 9,967 high-severity findings from two commercial platforms.
- The agent downgraded 58.5% of findings and upgraded 16.6% based on environmental context.
- Static severity scores fail to account for specific resource configurations and connectivity.
Cloud security platforms generate alerts based on static rules that assign a fixed severity level to every violation. This approach creates queues of high-severity findings that often do not reflect the actual risk within a specific environment. New research demonstrates that a significant portion of these alerts can be downgraded when evaluated against real-time environmental data.
The risk
Sola Security researchers Leon Goldberg and Gal Engelberg developed an AI agent to re-evaluate findings from third-party cloud security platforms. The team tested the agent on 9,967 findings labeled as HIGH severity from two commercial platforms across eight production environments. According to Help Net Security, the agent changed the severity grade for 75.1% of these findings. Most of these changes were downgrades, with 58.5% of findings moving to a lower risk category.
The researchers found that vendor rules assign a single severity score to each rule type, regardless of the specific resource or environment involved. This static approach ignores critical context, such as whether a flagged resource is connected to other systems or running active workloads. As a result, security queues are ordered by general case risk rather than the actual threat level in a specific deployment.
Who is exposed
The study highlights that many high-severity alerts stem from inert or unreachable resources. The largest pattern for downgraded findings, accounting for 32.3%, involved resources that were orphaned or attached to nothing. Other common reasons for downgrading included resources that were unreachable from the internet, missing live services, or protected by narrow source restrictions.
Conversely, 16.6% of findings were upgraded in severity. The agent raised grades when it found evidence that the condition was worse in that specific environment. This included scenarios where the condition was more severe, along with checks for firewalls, allowlists, or other plausible guardrails in the path.
Cost and compliance
Standard scoring frameworks like CVSS include environmental metrics to adjust base scores for specific deployments. NIST risk assessment guidance also ties likelihood to the controls currently in place. The researchers noted that static severity scores leave these contextual adjustments empty, forcing teams to treat general-case risks as immediate threats. This mismatch can lead to alert fatigue and inefficient resource allocation for security teams.
What happens next
Security managers should recognize that static severity scores may not reflect actual risk. Teams can use AI agents to validate findings against environmental context before prioritizing remediation efforts. This approach helps distinguish between genuine threats and inert resources that pose little danger.
Background: Firewalls
Firewalls are important because they enforce access policies at network boundaries, blocking unauthorized traffic before it reaches your devices. Without this filter, your systems face constant probing. This reduces the attack surface and prevents automated exploits from finding vulnerable services.
Read the full guide: Why Firewalls Are Important: The Hidden Costs of Missing Filters
What to do and how to stay safe: Sola Security
- Review high-severity findings to determine if the affected resources are active or connected to critical systems.
- Implement tools that can automatically check environmental context, such as internet reachability and attached workloads.
- Prioritize remediation based on dynamic risk assessments rather than static vendor severity scores.
- Monitor for patterns where inert resources generate high-severity alerts to reduce noise in security queues.
Step-by-step guide: Implement MFA for Cloud Accounts: A Step-by-Step Rollout Plan
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many high-severity findings were downgraded by the AI agent?
The AI agent downgraded 58.5% of the 9,967 high-severity findings tested in the study.
Why do static severity scores often misrepresent risk?
Static scores ignore environmental context, such as whether a resource is connected to other systems or running active workloads.
What was the most common reason for downgrading a finding?
The most common reason was inert resources that were orphaned or attached to nothing, accounting for 32.3% of downgrades.
