Why is security software generating so many false alerts?
Endpoint security software frequently creates severe alert fatigue by flooding systems with thousands of noisy warnings and heavy CPU usage. This constant disruption causes system performance issues, conflicts with background services like the search indexer, and forces administrators to repeatedly restore servers from backups.
What the numbers show
Counted from the threads quoted below. How we count
- The most recent one is from October 2026.
- This comes up 61.2× more often in r/msp than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Replacing the endpoint security software with alternatives like Huntress combined with Windows Defender or Defender for Endpoint (DfE)Did this help you?
- 2Creating policy overrides, exclusions, and custom rules to attempt to stop alert fatigueDid this help you?
- 3Waiting for the automated alert flood to stop on its ownDid this help you?
- 4Run DLP tools in monitor mode rather than blocking on day one.Did this help you?
- 5Set alerts to trigger log entries without sending instant emails until a threshold is hit.Did this help you?
- 6Generate reports for management to clarify acceptable business communication before enforcing strict blocking.Did this help you?
- 7Start with loose match rules and tighten them as real usage patterns are learned.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“No product is perfect but after having to restore servers from backup several times and the Dell software generating thousands of alerts despite an S1 "mitigation" I've had enough.”source ↗
“We started doing this last year.. S1 blowing up our RMM with no explanation or fix from S1.”source ↗
“I too am getting frustrated with the noise that is S1. Constant CPU and disk hog and conflicts with the search indexer service.”source ↗
“For the past few minutes I have been repeatedly receiving Microsoft 365 Defender threat analytics reports emails. I've received 34 in 2 minutes so far.”source ↗
“Yes, I was coming here to say the same thing”source ↗
“Same, a boat load of notifications.”source ↗
“My team is experiencing alert fatigue that burns out our analysts and frustrates evevry employee. Are there any tools that don't give a million false positives, or do we need to manually reconfigure everything no matter which vendor we go with?”source ↗
“problem for us is that the people are actually sending around the sensitive info via email so all the false positives arent even false positives, theyre true positives. just not malicious data exfil. what can i do lol”source ↗
“Ours arent false, like LickSomeToad mentions, its just course of doing business, where we need the alerts even though they arent malicious.”source ↗
Where this came up
People with this problem also raised
- 8Antivirus blocking legitimate software updates and installers
- 5Why does software installation fail on secure systems?
- 7Why are security warning emails so vague?
- 6Why does Microsoft Edge force ads and unwanted features?
- 4Why does security software lock out the entire organization?
- 16Why am I seeing ads in software I already paid for?