This seems incentivized by marketing, as every security demo I've ever had has included something like "See? Our tool found 46,291 possibly critical issues in your environment" and then you drill into them later and they're relatively insignificant issues you'd fix in a perfect world with unlimited labor but drown out the actual things you actually want to know about right now. I think there's also incentive to upgrade the threat urgency on alerts to look like they're capturing more urgent threats.

This is such an undervalued comment.

Completely reflects my experience. Most dashboards have 99%+ noise that is useless from an operational perspective, and the inefficiency of Blueteam vs Redteam usually represents "how long until I can find the actual data points that matter" in the dashboards.

(That was the reason I went with the peer-to-peer and SBOM idea, trying to reduce as much noise as possible)