Round-the-clock risk triage and escalation

Placeholder. Every figure on this page is invented. Replace before launch.

The situation

The alerting system was tuned conservatively, which is the right instinct and the wrong outcome: analysts spent most of a shift dismissing alerts that were obviously fine. Real signals were competing for attention with noise, and the overnight rotation was the hardest to staff and the easiest to miss something on.

What we built

A triage layer between the alert stream and the humans:

• Correlation groups alerts that are describing the same underlying event, so one incident arrives as one item rather than forty.
• Classification assigns severity using both the alert payload and the account's recent behaviour, which is the context a human was applying implicitly and the old rules engine could not.
• Escalation wakes someone when the severity and the confidence both clear a threshold — and, deliberately, when confidence is low on a high-value account. Uncertainty escalates rather than resolving quietly.

The part that mattered

Most of the engineering went into the evaluation harness, not the model. On a risk system, "it seems better" is not a claim anyone can act on. We replayed six months of historical alerts with known outcomes and measured false-negative rate against the previous rules engine before any of it reached production.

That harness is still the thing that lets them change the system safely.