Triage (Security)

The term comes from hospital emergency rooms. When ten injured people arrive at the same time, a specialist first briefly looks at all of them. They decide who must go into the operating room immediately and who can wait an hour. This pre-sorting is exactly what is called triage. In IT security, things work similarly: in a large company, thousands of automatic alerts come in every day, along with external reports of possible vulnerabilities in the company’s own software. A team cannot check everything at once. So it sorts first, instead of fixing right away.

Why a thousand alerts are worse than ten

Security tools are deliberately suspicious. They would rather report too much than too little. The result is a flood of alerts, most of which are harmless. An employee made a typo, a backup ran at an unusual time, an update changed a file. Experts call such alerts false alarms or, in English, false positives.

The problem is not the individual false alarm, but the sheer mass of them. Anyone who clicks away a hundred harmless warnings every day will eventually click away the one real one too. This effect is called alert fatigue. Several major data breaches unfolded exactly this way: the warning was there, it just got lost in the noise.

Triage is meant to prevent exactly that. It creates a deliberate ranking instead of following the order in which alerts arrive. This also makes it possible to measure how well a team is working. A typical metric is the time from the report to the first assessment.

How a case gets classified

At the start there is a quick check: is the alert even real? To do this, the team looks at log files, meaning the automatic records of what happened on a computer. If the alert matches a normal process, the case is closed. If a suspicion remains, the process continues.

After that comes classification by severity. Two questions matter: how bad would the damage be, and how likely is it? An attacker with administrator rights on a customer-data server is an emergency. A flaw in a test system with no internet connection is not, even if it sounds technically dangerous. For software vulnerabilities there is a common scoring scale from 0 to 10 for this, the CVSS. However, the score alone is never enough, because it does not know the company’s own setup.

In the end, every case is assigned a level, often ranging from “critical” to “low”, and given a deadline. Critical cases go to experienced analysts who dig deeper. The rest go into a queue. The distinction matters: triage is only the sorting. The actual investigation and the fix are separate steps that come afterward.

Bug bounty reports, SOC shifts, and AI assistants

Large companies operate a Security Operations Center, or SOC for short. This is a team that monitors alerts around the clock in shifts. The bulk of this work is triage. Anyone starting out there as an entry-level employee does practically nothing else.

The term also comes up in bug bounty programs. In these, companies pay money to outsiders who report security vulnerabilities. At providers like Google or Microsoft, thousands of reports come in per year this way, many of them duplicates or nonsense. A dedicated triage team checks whether a report is new and genuine, and decides on the size of the reward. When security researchers publicly complain that their report has “stalled in triage,” this is exactly the step they mean.

For some years now, AI systems have been taking over parts of this pre-sorting. They bundle related alerts together, write a summary, and suggest a level. This is a major selling point in the security industry’s sales pitches. The decision on critical cases, however, still rests with humans, because a wrongly dismissed alert remains invisible until the damage is done.