Solutions that detect malicious behavior based on anomalous behavior are struggling as current events consistently redefine the meaning of “normal activity.” Patterns that AI-based engines have learned over the past few years are being revealed as irrelevant with the sudden, massive changes in user behavior now being recorded. SOC teams, already investigating an avalanche of false positives, are bracing for unprecedented alert fatigue as quick triage becomes more necessary than ever.