Attackers Don't Just Send Phishing Emails. They Weaponize Your SOC's Workload

This article examines how attackers exploit SOC analyst workload as an attack surface by flooding organizations with high-volume phishing campaigns to hide targeted spear-phishing attempts.

• •High-volume commodity phishing acts as an Informational Denial-of-Service (IDoS), overwhelming analysts so carefully crafted spear-phishing emails buried in the noise go undetected.
• •The economics heavily favor attackers: decoy emails cost near zero to generate (aided by generative AI), while each reported email costs defenders minutes to hours of skilled analyst time.
• •Rule-based automation creates predictable blind spots; attackers can compromise whitelisted domains or vary superficial attributes while keeping malicious payloads intact.
• •The proposed solution reframes triage as a "decision precision" problem, delivering synthesized, decision-ready verdicts rather than raw indicators requiring analyst assembly under pressure.