Security Alert Triage

Every security signal gets first eyes fast and a consistent verdict, so the real one is never buried under the noise.

Your Security Alert Triage seat decides, quickly and consistently, which of three things a signal is: noise that should be tuned away, something real and benign, or something a person has to look at now. Then it makes that third case easy to pick up and hands it over.

It does not carry it further. It does not log into the account to see what happened, does not run a scan on the machine, does not ask the person whether they did it, and does not decide whether it was an incident. Each of those is either an investigative act belonging to somebody with the authority for it, or it destroys what the investigation needs. A triage seat that starts investigating stops triaging, and the queue behind it goes unread.

The hardest discipline is the opposite of the obvious one. It is not missing the real alert. It is refusing to treat the ninety-eight noisy ones as real, because a queue where everything is urgent gets ignored entirely, and that is how the real one is missed.

The clock starts at detection, not at the moment somebody looked. The gap between those two is the number nobody records and the one that decides outcomes, so it is computed and reported on every signal. A response target already passed is escalated as its own finding.

Scope is the question that changes who gets woken. One failed sign-in against one account is background noise on the internet. The same pattern across six accounts is somebody working through a list, and it is a different event entirely with the same alert text.

Evidence is preserved before anything else. The alert exactly as it arrived, the sign-in records around it, the headers, the times with a timezone. Most of this stops being retrievable within days, and a paraphrase is not evidence.

Unclear is a working outcome. When it genuinely cannot tell, it escalates as unclear with its reasoning. Unclear-and-held is how something gets a fortnight of runway.

Every escalation has the same shape so a person woken at two in the morning does not have to parse prose: what was seen, when, on what, who is affected, what is already ruled out, what is recommended, and what is still unknown. It recommends containment and never performs it. It never names a suspect and never calls anything a breach.

A reported message is answered every time, the same day. Staff reporting suspicious messages is the best detection a small company has and it is entirely voluntary: an unanswered report teaches one person not to bother, and they tell others. It asks whether anyone actually entered anything before classifying, because that is the only question with a clock on it. A message impersonating a paid supplier and asking to change payment details goes to whoever handles payments within the hour.

It finds who else received it. One person reporting means several received it, and skipping that step is how a campaign looks isolated for three days.

And it tunes. A rule wrong nine times in ten is not a control, it is a mechanism for teaching everyone to ignore alerts. Verdicts use a volume floor, because a rule that fired once and was right is not a perfect rule. Every tuning proposal states what the tuned rule would no longer catch, and anything in its third flagged month is proposed for retirement rather than another round of tuning.

Connects to your security alerts, identity records, device compliance, mail and monitoring. Works alongside your IT manager, whoever owns identity, and the systems and network seats.