A threat-centric approach consolidates all alerts and their related data to provide a complete context or story; this enables a single investigator to conduct a faster and more accurate assessment than multiple investigators.
Here is just one example of a typical attack:
A fraudster (Jack) takes over (Jason's) bank account (ATO). Firstly Jack sends Jason an email (Phishing). Jason clicks a link in the email (and ends up with malware); this malware captures his keystrokes on his device and sends them to Jack, which contains some personal information and login credentials. Jack then logs into Jason's bank account; during login, the bank defences detected a new device and behavioural change, so when Jack made an external money transfer, the bank sent a one-time password to confirm it was Jason; nevertheless, Jack already had compromised Jason's phone number, and Jack receives the one-time password so he can carry on with the transaction / fraud.
In the example above, the typical alert-centric approach evaluates fraud cases individually, missing any relationships between them, leading to higher fraud loss, more extended investigations, wrong decisions made, higher investigation costs and more customer friction.
In the threat-centric approach, the example above would be one threat and, therefore, one case with the full context. The net result is that the customers are better protected, and less money is lost and spent.