At the TNW Conference Europe in Amsterdam, Marina Segal, CEO and co‑founder of Israeli‑European startup Tamnoon, unveiled the company’s new "NoAction Engine" – a machine‑learning layer that sits atop existing CSPM and SIEM tools and automatically suppresses low‑risk alerts, allowing security teams to focus on genuine threats. Tamnoon, founded in 2021, raised €18 million in a Series A round led by Balderton Capital with participation from European VC firms LocalGlobe and Speedinvest. The company says it now protects over €2.3 billion of annual cloud spend for roughly 150 European enterprises, including fintechs in Germany, health‑tech firms in France, and manufacturing groups in the Nordics. Segal highlighted that, despite a decade of investment in visibility‑first cloud security, an estimated 48 % of detected misconfigurations remain open because teams are overwhelmed by alert volume.

Alert fatigue is not just an annoyance; it translates directly into higher breach risk and operational cost. A 2023 Ponemon study found that European enterprises lose an average of €1.2 million per year investigating false‑positive cloud alerts. By shifting the paradigm from "see everything" to "know when not to act," Tamnoon’s approach could cut false‑positive rates by up to 60 % according to early pilot data, freeing analyst hours for threat hunting and reducing mean time to contain incidents. This aligns with the EU’s NIS2 directive, which emphasizes effective, proportionate security measures, and with growing pressure from European regulators for cloud providers to demonstrate measurable risk reduction rather than mere logging. If successful, the model could become a de‑facto standard for cloud security stacks across the continent, influencing procurement criteria for public‑sector cloud contracts worth billions of euros.

Winners include Tamnoon itself, which stands to capture a larger share of the €12 billion European cloud security market; European cloud providers (AWS EU, Azure EU, OVHcloud, and Google Cloud’s Frankfurt region) that can offer integrated "no‑action" capabilities as a differentiator; and CISOs at regulated industries who gain a concrete tool to meet NIS2 compliance without expanding teams. Losers are legacy SIEM and CSPM vendors whose business models rely on high alert volumes to justify licensing fees, as well as consultants who profit from alert‑triage services. Broadly, enterprises that cling to a "more alerts = better security" mindset risk falling behind in both effectiveness and cost efficiency.

truncated