Round-the-clock risk triage and escalation
Risk alerts were triaged by analysts on rotating shifts, which meant the quietest hours had the thinnest coverage. We built a triage layer that handles the volume and wakes a human only when it should.
Results
- 24/7
- Automated first-pass triage
- −73%
- Alerts reaching a human
- <40s
- Median time to escalation
Placeholder. Every figure on this page is invented. Replace before launch.
The situation
The alerting system was tuned conservatively, which is the right instinct and the wrong outcome: analysts spent most of a shift dismissing alerts that were obviously fine. Real signals were competing for attention with noise, and the overnight rotation was the hardest to staff and the easiest to miss something on.
What we built
A triage layer between the alert stream and the humans:
- Correlation groups alerts that are describing the same underlying event, so one incident arrives as one item rather than forty.
- Classification assigns severity using both the alert payload and the account's recent behaviour, which is the context a human was applying implicitly and the old rules engine could not.
- Escalation wakes someone when the severity and the confidence both clear a threshold — and, deliberately, when confidence is low on a high-value account. Uncertainty escalates rather than resolving quietly.
The part that mattered
Most of the engineering went into the evaluation harness, not the model. On a risk system, "it seems better" is not a claim anyone can act on. We replayed six months of historical alerts with known outcomes and measured false-negative rate against the previous rules engine before any of it reached production.
That harness is still the thing that lets them change the system safely.
Have something like this?
Start with the free audit, or book twenty minutes and we'll tell you whether we're the right studio for it.