Every security tool eventually faces the same accusation: "it's noisy." The standard response is to tune detection — raise thresholds, suppress classes of findings, ship a quieter product. We think that diagnosis is mostly wrong. The volume of real findings is what it is; the reason teams drown is that every finding arrives with the same urgency, in the same channel, addressed to everyone — which means no one.
Noise is what signal becomes when it is badly routed.
The three routing failures
Watch a vulnerability alert die and you will see one of three failures:
- No severity routing. A critical, actively-exploited CVE in an internet-facing product and a low-severity finding in a build-time dependency arrive as the same notification. Recipients learn — rationally — that notifications don't mean anything, and mute the channel. The mute is not apathy; it is correct Bayesian updating on a channel with no information density.
- No ownership routing. The alert goes to a shared security channel rather than to the team that owns the affected product. Everyone assumes someone else will pick it up, and the finding ages until a compliance scan rediscovers it.
- No destination routing. The alert lands in email while the on-call engineer lives in Slack and the incident process starts in the SIEM. An alert that requires a human to copy it between systems is an alert with a manual step in front of every response.
Routing as configuration, not culture
The fix is unglamorous: alerts need rules, and the rules need to encode decisions you make once, calmly, instead of decisions made per-alert under fatigue. In SBOMVault this takes the shape of alert rules with conditions and destinations — route by severity and exploitability, scope rules to specific products or vendors so findings reach the team that owns the component, and deliver to where response actually happens: chat via webhooks, email for the digest tier, or your SIEM for findings that should enter the formal incident pipeline.
The prioritization layer matters just as much as the plumbing. Routing on raw CVSS recreates the original problem one level down, because CVSS alone marks a third of everything critical. Routing on risk — exploitation probability, KEV membership, reachability — is what makes "page me for critical" a sentence that pages you rarely enough that you come when called.
The metric that matters
Teams measure alert volume; they should measure alert yield — the fraction of notifications that led someone to do something. A channel with five alerts a week and four actions taken is a healthy nervous system. A channel with two hundred alerts and three actions is training your organization to ignore you, at a cost you will pay during the one alert that mattered.
Tune your routing until the yield is high, and volume takes care of itself. The goal was never fewer alerts. It was fewer wasted ones.