Beyond Alert Fatigue: How a Data-First Approach Is Reshaping Security Operations

If you've spent any time in a Security Operations Center, you know the drill. Screens filled with alerts. Analysts context-switching between a dozen different dashboards. The constant, nagging question: is this one actually important?

Human Managed's founder Saleem has spent 25 years in the cybersecurity field, and his assessment is blunt: the fundamental challenges—alert volume, analyst burnout, lack of context—remain largely unsolved despite waves of new technology.

Most organizations approach security operations as a tool problem. When something breaks, buy new software. When alerts pile up, add another dashboard. When analysts burn out, hire more people.

The Human Managed team argues for treating security as a data problem instead. Rather than building yet another detection tool, we focused on how data flows through security operations—and where that flow breaks down.

CEO Karen Kim draws a distinction between traditional approaches that present data to humans versus making data the central player. The difference: front-loading analysis and contextual understanding so that by the time information reaches an analyst, the heavy lifting is already done.

There's a metric that rarely appears on security dashboards but might be the most important one: the gap between when something happens and when someone makes a decision about it.

Consider a practical example: file transfer monitoring. Uploading files to cloud storage is normal activity. But telemetry can reveal patterns—a user uploading to a non-organization-owned online drive. That's one data point.

Add context through automated enrichment: the user has elevated permissions, access to confidential data, and resigned a week ago.

The individual facts weren't alarming. The pattern—assembled automatically, enriched with context—absolutely is. And critically, this analysis happened in microseconds rather than hours of manual investigation.

Any system that automates triage decisions must establish credibility with analysts. The Human Managed approach uses AI not just for detection but to articulate why a decision was made. Statistical models handle pattern recognition and scoring. Language models communicate findings in human-readable form.

The messaging design also combats alert fatigue deliberately. New customers receive a baseline configuration filtering for only critical and high-severity alerts—because user research revealed that people who want everything become overwhelmed within days and stop checking entirely.

The platform demonstrates four-minute average triage times—compared to industry standards that often stretch to hours. Alerts arrive enriched with asset context, threat intelligence, and business impact assessments. AI provides not just severity scores but explanations and recommended actions.

The cybersecurity industry has spent decades building sophisticated detection capabilities while largely ignoring what happens after detection. Alert fatigue isn't a bug—it's the predictable outcome of prioritizing identification over action.

Twenty-five years is long enough to solve the same problems. The technology finally exists to do something different.

Want to see how Human Managed approaches SecOps differently? Check out the full video series 

 on the Human Managed YouTube Channel where team members walk through the platform, philosophy, and technical architecture behind modern security operations.

This article is written based all videos in our Secops video series.

A deep dive into why the cybersecurity industry's biggest challenges haven't changed in 25 years—and what's finally different now

This bootstrapped data platform has been profitable for six years without a cent of VC funding. But the real story isn't about the company—it's about the people who built it. After 10 episodes of conversations with the team at Human Managed, we learned not just how to build resilient security operations, but also how to build meaningful careers in tech without following a straight line.

1. The Degree That Got You Here Won’t Define Where You Go

From aerospace engineering to Kubernetes administrator. From linguistics PhD to design ops lead. From physics major to front-end engineer.

The career paths inside Human Managed aren’t just unconventional — they’re a feature, not a bug.

As Wei Xiong Lee, now a cloud architect, put it: 

“Your diploma at 18 doesn’t define your career at 28.”

His path was paved by two hours of nightly self-study, certifications earned on the side, and the willingness to adapt.

That theme repeats across the team: diverse backgrounds became competitive advantages. Different ways of thinking — systems from physics, language patterns from linguistics, precision from aerospace — enriched how they built, designed, and solved problems.

 skills can be taught. Attitude, initiative, and perspective are harder to find. Hire for curiosity and ownership, not just credentials.

Every enterprise collects more data than it knows what to do with. The real challengeisn’t storage — it’s meaning.

“You still have to tie it back to what the business needs. You have to tie it back to what problems you are solving.”

This insight hit home for regulated industries like finance and healthcare, where compliance gaps often come from data mismatches. Dashboards may look complete, but what’s captured in the system doesn’t always match reality.

 measure ROI not by how much data you collect, but by how effectively that data answers critical business questions.

3. AI Won’t Replace You — But Colleagues Who Use It Might

AI showed up in almost every episode, but not in the way you expect.

“AI is a tool that needs to be guided by humans to produce the best results.”

Adam Spiers, our Lead AI Engineer, built a framework he calls 

Human Learning Through Machine Learning (HLTML) 

— a reminder that the goal isn’t replacement, but amplification.

“The person who uses AI won’t be replaced. The person who doesn’t will be,”

“AI can feel like a team of 50 — but you still have to validate every output,”

“Don’t spend months learning tools. Learn in a week and move forward,” 

 the advantage isn’t in mastering one tool — it’s in continuously adapting to new ones while keeping your fundamentals sharp.

4. Build Systems Like Lego, Not Monuments

Technology stacks grow old fast. The difference between adaptable and obsolete often comes down to architecture.

“Think Lego blocks. The ones from 30 years ago still work with the blocks today.”

That modular, composable approach has saved Human Managed from costly rewrites, while enabling them to adopt new technologies quickly. Combined with a multi-cloud strategy (AWS, Azure, and GCP), the company avoided vendor lock-in and gained resilience.

 invest in platforms that evolve without forcing reinvention. Backward compatibility isn’tjust good engineering — it’s good economics.

You can buy tools. You can’t buy initiative.

Grace Salazar, our Community Ops Officer, 

“Skills can be developed, but attitude is hard.”

Human Managed runs distributed teams across Singapore, Manila, and India, blending graduates, interns, and experienced experts. The flat structure means interns can challenge senior engineers — and sometimes they’re right. That dynamic fuels innovation faster than hierarchy ever could.

 the best defense isn’t just technology, but a culture of ownership where people feel empowered to act.

Finally, there’s the matter of money. That is tied to value generated, not borrowed. In an industry where startups raise millions before shipping a product, Human Managed chose to stay bootstrapped. 

 explained Director of Operations Roshanara Basheerudin. Every dollar had to be tied to customer value — not vanity metrics.

That constraint became a discipline: build modular, stay multi-cloud, prioritize explainability, and keep customers at the center.

 constraints sharpen focus. And for enterprises choosing vendors, profitability is often a better signal of resilience than investor decks.

Final Thoughts: Technology Is Still Human-Centered

 series wasn’t about data pipelines, AI models, or cloud strategies. It was about 

Whether it was fraud detection models that highlight anomalies but rely on humans to interpret them, or engineers rewriting code eight times to get it right, the pattern was clear: technology scales what people imagine, but it doesn’t replace their judgment.

That’s why “Humans in the Loop” wasn’t just a series title. It was the philosophy that’s kept our bootstrapped company profitable while venture-backed peers stumbled.

For enterprises, the lessons are straightforward:

Because the future of cybersecurity won’t belong to those with the biggest budgets. It will belong to those who put humans — their judgment, creativity, and initiative — at the center.

👉 What challenges has your organization faced in balancing security investments with measurable business outcomes? 

Watch all 10 episodes of Humans in the Loop to hear these stories firsthand.

What 10 Episodes of "Humans in the Loop" Taught Us 

“If I could visualise my ideal decision-making progress as a chart, it would be up and down—up being good decisions and bad being not-so-good decisions, but it’s moving fast. It’s moving fast, and the downward lines are getting shorter and shorter each time because I’m learning from the mistakes. We’re just making the cost of making a mistake smaller and smaller each time.” - Karen Kim, CEO of Human Managed.

In most workplace environments, there is a particular pattern and structure for organisational decision-making, where managers and consultants come into place. It may seem like interns and decision-making are far-fetched, but it may not just be.

Interns need to aim for a career trajectory that involves a lot of decision-making, especially when looking for roles with leadership potential.

To delve deeper into the importance of decision-making and its prospects in internships, we're excited to welcome 

 , a leading analytics, cybersecurity, and information technology platform dedicated to facilitating and improving intelligent decision-making.

Through our podcast episode, she explains that in the new age of digital reformation and AI advancements, it is important to strategise decision-making into smaller components, or 'buckets', and approach them likewise.

Read our full blog on decision-making here: 

https://capital-placement.com/blog/why-is-decision-making-important-for-interns/

Or listen to our full episode with Karen Kim here:

https://open.spotify.com/episode/5GSGwoksucYIRi9H7qje2m?si=6d11f89d67664336

https://www.youtube.com/watch?v=TJywap6z9x8

This article was originally published on 

Interns and their growing connection with decision-making

It’s been almost a year since I joined Human Managed, and so I wanted to celebrate this milestone by writing about how I got acquainted with, and later on became deeply immersed in Conversational AI.

I received my PhD in Applied Linguistics about 6 years ago in hopes that I could use it anywhere but the academe. The reason why demands a separate and more personal blog post. I digress.

I stopped hoping after realizing that being a female forensic linguist in Manila involved too many risks and also after receiving feedback from traditional corporations that I’m “overqualified” for the positions I were applying for. It was a sad fate because in almost every aspect of my life, never did I mind being a beginner for the sake of learning.

Fast forward to July 2019 when I was introduced to Saleem, one of our founders. He told me that he had been looking for a linguist to be one of the drivers of HM’s Conversational AI campaign. I clarified that my degree didn’t cover Computational Linguistics, but he confirmed that he knew that and didn’t need another technical person in the team. I remember being intimidated after hearing the word AI but also feeling excited about the possibilities it would open for learning and growth. I decided to use that hint of self-doubt to my advantage and kick start my journey. But starting wasn’t as easy as I hoped.

As I joined HM in August 2019, I immediately brainstormed my first use case: a mission critical conversational interface for CxOs to extract real-time information on their organization’s security posture. I was just dipping my toes into Cyber Security as well so I began to write my first Happy Path (note that I didn’t know this term back then, let alone conversation design) to see if my understanding of the task was clear. Unfortunately, I don’t have a copy of this first conversation flow, but I do remember that the comment I received for it was, “Why does your bot sound like a know it all?”

It’s funny thinking about it now, but I was panicking then. Apparently, I shouldn’t be cramming too much information in the response (for reasons I promise to elaborate in a separate post). Sensing that I was somehow lost, I was advised to observe how comics are written and to research on work that’s being done in RASA. This was the turning point for me to stop creating and start learning.

The easy route isn’t always the best route

Conversational AI was a relatively new field back then and very few organizations had been exerting efforts to democratize it. RASA was one of the first companies who made it their mission to open source the standard infrastructure they have built for conversational AI, and with the help of a community that has grown exponentially within the past year, they have gone a long way to develop their technology, from introducing a UX to train chatbots to making their components ready for deployment with Docker or Kubernetes.

I also came across Dialogflow, which seemed to be the stronger contender for a starting point given it’s practically ready to use even without any coding experience. However, even though going Google was the easier route, I knew it wasn’t the best fit given the complexity of our use case. I also thought that if I were to switch to Dialogflow at some point in time, the transition would be so much easier, and the learning curve wouldn’t be as steep.

Coincidentally, I also came across a post marketing the September 2019 RASA Summit in San Francisco. The agenda seemed to cover topics I needed to know to become a “legitimate” member of the Conversational AI community. I made a pact to myself that by the time I got to the Bay Area, I should have already demonstrated understanding of how the components worked by building and training a simple FAQ chatbot using their platform. I made it my mission knowing it was the best way to get the most out of the sessions from the summit. This initiative was the start of how my knowledge expanded to Conversation Design to Machine Learning frameworks. The rest, as they say, is history.

The tweet that deserved a pair of socks. I won for being one of the participants who traveled the farthest for the conference.

Aside from knowing what’s inside the technology, learn more about what you can get out of it

It’s true that I shouldn’t have focused on the technology first. But in my attempt to uncover the value we can get out of RASA’s framework, I was able to gain an understanding of not only what constitutes good conversation design but also what it takes to learn something new in my 30s. 

First is that I’m still capable of learning something new even if it’s a topic you’re intimidated by. Truth be told, I’ve spent most of my life not knowing how to launch the CMD prompt whereas now, I can manage it from a Type 2 hypervisor. I now understand the 

 programmers get when they are able to successfully execute commands.

Second is that learning is amplified when you are part of a community. I guess what even drew me closer to RASA is that, like us here at HM, they have high regard for their community. The web of network they have built opened the door for me to meet the key players in the industry, and the best practices they adhere to. I came across advocates of good conversation design and tools our team can use from inception to launch.

This is just the beginning! I look forward to sharing more of my chronicles with you.

Note: This blog was originally published in August 2019 and has been updated for accuracy. 

Categories

Culture

Beyond Alert Fatigue: How a Data-First Approach Is Reshaping Security Operations

What 10 Episodes of "Humans in the Loop" Taught Us

Interns and their growing connection with decision-making

From Zero to Tech: An Applied Linguist’s Journey to Conversational AI