Volume, Fatigue and What Gets Missed

An insider programme with more alerts than reviewers does not simply fall behind. It changes how every alert is handled, including the ones that matter.

The practical lesson in “Volume, Fatigue and What Gets Missed” is that visibility is not certainty. For teams researching key person dependency, the product website can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.

What happens to a reviewer under volume

The time per item collapses. A judgement that should take twenty minutes takes two.

For a separate perspective relevant to “Volume, Fatigue and What Gets Missed”, consult the CrowdStrike insider-threat guide. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

Pattern-matching replaces assessment: items that look like the last hundred nothings get closed like the last hundred nothings.

And the threshold for escalating rises, because escalating costs time the reviewer does not have.

That last effect is the dangerous one. Under volume, the system becomes less likely to escalate exactly as it becomes more likely to be sitting on something.

The second failure

Innocent people get handled carelessly in both directions.

Some are closed without the ten minutes that would have established context properly, which is fine until one of them is later reopened and nobody can say what was checked.

Others are escalated because escalating is faster than resolving, which puts somebody into a process they should never have entered.

Why reducing the queue is a rule problem

The instinct is to add reviewers. The arithmetic rarely supports it: the volume comes from rules, and rules that fire constantly are usually rules nobody has examined.

Per rule: how many times did it fire last quarter, and how many of those led anywhere. Most programmes find a handful of rules producing most of the volume and almost none of the findings.

Turning those off is the intervention. It is unpopular because it feels like reducing coverage, and the coverage was notional.

The honest position on what is missed

A programme operating at capacity is missing things, and saying so is better than implying otherwise.

What should be said upward: at current volume we can give this many minutes per item, which is adequate for this kind of alert and not for that kind. Here is what we would need to do the second properly, or here is what we propose to stop monitoring.

That is a resourcing conversation with a real choice in it. The alternative is a programme that appears to cover everything and does not.

The measurement to keep

Time from alert to first review, and time to closure. Both rising means the queue is winning.

Alerts closed with no notes, which is the signature of a reviewer under pressure.

And the proportion closed within minutes, which tells you how much of the programme is actually mechanical dismissal.

What a reviewer stops doing first

Under volume the first casualty is the contextual check: the minute spent establishing what the team was working on. It is the step with the highest resolution rate and the lowest visible output, which makes it the easiest to drop and the most expensive to lose.

The honest conversation upward

At this volume we can give this many minutes per item. That is adequate for this category and not for that one. Here is what we propose to stop monitoring, or here is what we would need. Framing it as a choice rather than a complaint is what gets it heard, and it puts the decision where it belongs.

Three rules, usually

Programmes examining their own volume typically find a small handful of rules producing most of the alerts and almost none of the findings. Retiring them is the whole intervention and it is resisted because it feels like reducing coverage that was never real.

What the measures show

Time from alert to first review, proportion closed within minutes, and alerts closed with no notes. All three are available and all three describe a programme under pressure more accurately than any account of how busy the team feels.

For the file: A queue that cannot be cleared is not a staffing problem until the rules generating it have been examined. Most of the volume is usually three rules.