# AIDA framework cuts SOC alert misses to 3% in new study

> Researchers show their multi‑agent system reduces false‑negative alerts from 40% to 3% while keeping most decisions automated.

Oossa · 2026-10-09 · https://oossa.com/en/aida-framework-cuts-soc-alert-misses-to-3-in-new-study

A team led by Saimon Amanuel Tsegai released a preprint describing AIDA, a multi‑agent system for security operations centers. AIDA forces agents to propose a decision, let a separate agent challenge it, and require stronger evidence before dismissing alerts. On a benchmark of 1,247 alerts from a staged attack, AIDA reached an F1 score of 0.958 and lowered the false‑negative rate to 3.1%, compared with 40.4% for five earlier methods.

## The facts

- Published on 2026-10-09
- AIDA reduced false‑negative alerts from 40.4% to 3.1% on ALERT‑BENCH

## Why it matters

SOC teams could rely more on automated triage, letting analysts focus on the 18% of alerts that still need human review.

## Sources & references

1. [From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage](https://arxiv.org/abs/2610.10608) – arXiv cs.MA, 2026-10-09

Last updated: 2026-10-09