Newsletter Article
From detecting deviations to identifying the decisions that deserve attention.
Every operation runs on alerts. A queue crosses a threshold, a metric moves outside its expected range, a system flags an exception, and someone is notified. Alerts are among the most direct links between data and action in any organisation.
They are also among the most taken for granted. Many alerting rules were written years ago, around a single metric and a fixed limit, and have accumulated layer by layer since. The result is familiar to most operations leaders: plenty of notifications, and a constant judgement call about which ones deserve attention.
AI and connected data create an opportunity to raise the usefulness of every alert. Gartner predicts that by 2027, 50% of business decisions will be augmented or automated by AI agents for decision intelligence. Alerts are where many of those decisions begin. Designing them to carry context, priority and a clear link to action is one of the most practical ways to put that prediction to work.
This article looks at when an alert deserves to interrupt someone: the five dimensions that make an alert intelligent, how related signals become a single developing condition, what recent research reveals about using AI to focus attention, and how to audit the alerts you already have.
Thresholds remain essential, and operations need more alongside them
Fixed thresholds are the right tool for clear, deterministic conditions. A system outage, a regulatory limit, a contractual service level or a safety boundary should trigger a predictable response every time. Simplicity and auditability are strengths in those cases.
Operational importance, though, is usually contextual. A short increase in average handling time at 9:00 a.m. on a Monday may be entirely normal. A longer queue at lunchtime may be expected. A rise in transaction volume may reflect seasonality, a marketing campaign or a public holiday rather than deterioration. In field service, a jump in open jobs matters far more when technician capacity is also constrained. In retail fulfilment, a spike in order volume matters most when it coincides with a stock or carrier issue.
A single-metric threshold sees only one of those dimensions. It can confirm that a number moved. Understanding whether the movement matters requires additional context, and that is where the next generation of alerting adds its value.
The five dimensions of an intelligent alert
More intelligent alerting evaluates several dimensions together before deciding whether, and how, to notify someone.
- Expected behaviour. Is the movement unusual for this time of day, day of week, season, location, customer group or operating condition? Contextual baselines let a system distinguish a genuine anomaly from a predictable pattern.
- Business impact. Which service levels, customers, costs or commitments could be affected? A modest change in a critical service may warrant more attention than a dramatic change in a low-impact one.
- Persistence. Is this a momentary fluctuation or a developing pattern? Requiring a condition to hold across a defined window, or to strengthen over successive intervals, filters out noise without hiding real issues.
- Urgency. How quickly could the situation deteriorate, and how much of the decision window remains? An alert that arrives after the point of effective intervention has limited operational value.
- Actionability. Is there a practical, permitted response available? If nobody can act on the condition, it may belong in a report or a trend review rather than an alert.
| Dimension | The question it answers | Data that typically answers it |
| Expected behaviour | Is this unusual for these conditions? | Historical patterns, seasonality, calendars, forecasts |
| Business impact | What outcome is at stake? | Service targets, customer segments, contracts, cost models |
| Persistence | Is it developing or passing? | Interval trends, rolling windows, rate of change |
| Urgency | How long until it is too late? | Forecasts, queue dynamics, deadlines, decision windows |
| Actionability | Can someone do something useful? | Workforce capacity, skills, policies, approved workflows |
No single application holds all of this. Expected behaviour lives in historical analytics, business impact in service and customer systems, and actionability in workforce and policy data. Intelligent alerting is therefore as much a data-connection challenge as an analytical one.
From many signals to one developing condition
One of the clearest benefits of intelligent alerting is consolidation. When an operation starts to come under pressure, several metrics usually move at once. Treated independently, each generates its own notification. Treated together, they describe a single condition with a single set of response options.
Consider an illustrative retail fulfilment scenario on a Thursday afternoon:
FOUR SEPARATE NOTIFICATIONS
|
ONE INTELLIGENT ALERT
“Next-day delivery is at risk for around 2,400 orders placed after 1:00 p.m. Order volume is 22% above the comparable Thursday, the afternoon carrier collection is running 90 minutes late and pick rate at the Eastern DC is below plan. Suggested next steps: bring forward the website cut-off message, route eligible orders to the alternate carrier and brief the contact centre on revised delivery dates.” Owner: Fulfilment Operations Manager · Evidence: order management, warehouse, carrier feed, contact centre |
Illustrative scenario. Figures are examples, not customer results.
The second version does more than reduce notification volume. It connects the signals to a likely cause, quantifies the window for action, identifies who owns the response and points to a feasible option. Notice that the contact centre appears twice: as a source of evidence and as a team that needs to act. The same pattern applies elsewhere: a utility can group outage reports, network telemetry and call demand into one incident view; a contact centre can connect volume, handling time and staffing into one service-level risk.
Grouping does not mean hiding detail. The underlying signals remain available as evidence, so the recipient can verify the picture rather than take it on trust.
What public health monitoring reveals about alert fatigue
Some of the most useful evidence on intelligent alerting comes from outside customer experience.
Researchers from Carnegie Mellon University and Johns Hopkins University have described a human-in-the-loop monitoring system deployed at a national public health organisation, published in the Proceedings of the AAAI Conference on Artificial Intelligence in 2026. Public health experts need to monitor very large volumes of data and flag the individual records that signal outbreaks or data-quality problems. Traditional alert-based approaches struggled to keep up and generated large numbers of unhelpful alerts.
The team replaced binary alerts with ranking-based AI anomaly detection, so reviewers saw the most significant records first rather than an undifferentiated list of rule breaches.
| RESEARCH SPOTLIGHT
• Analyses up to five million data points a day. • Built through a multi-year participatory design process with researchers, engineers and public health data experts. • Over a three-month longitudinal evaluation, delivered a 54-fold increase in data-reviewer efficiency, with higher engagement, compared with traditional alert-based methods. Joshi et al., Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40 (IAAI track), 2026. |
This is a public-health deployment, not a contact centre or enterprise operations study, and the result should not be read as a benchmark for other settings. The design lessons, however, transfer well:
- Rank, don’t just flag. Ordering signals by significance gives people a manageable starting point and makes the most important items hard to miss.
- Design with the people who act. The system balanced goals such as user control and efficiency because its users helped shape it.
- Keep humans in the loop. Automated prioritisation focused attention; experts still verified what mattered.
- Measure usefulness. The evaluation tracked reviewer efficiency and engagement over time, not only detection accuracy.
AI creates value by helping people decide which signals deserve investigation, and by giving them the context to act on what they find
Audit the alerts you already have
Three numbers worth tracking
- Actionable alert rate: the share of interrupting alerts that led to an action. A low rate signals noise.
- Interruptions per person per shift: a simple attention budget. If it keeps rising, ranking and merging are not doing enough work.
- Alert-first detection rate: the share of significant incidents that an alert surfaced before a customer, colleague or executive reported them. This is the clearest sign that alerting is earning its place.
Run the audit again after any redesign. The alerts that survive as interruptions are the ones worth redesigning in detail, and the Decision-Ready Alert Canvas provides a worksheet for that next step.
Most organisations do not need more alerts to get started. They need a clear view of the ones they already send. Site reliability engineering offers a useful bar: Google’s SRE guidance holds that an alert which interrupts a person should be actionable, warrant a sense of urgency and require human judgement. Anything else belongs somewhere other than an interruption.
A two-week audit of a single operation is usually enough to see the pattern. List every alert that reaches a person, then record how often it fired, how often someone acted on it, who received it and which of the five dimensions it already considers. Then sort each alert into one of five categories:
| Category | The test | What to do with it |
| Interrupt | Actionable, time-sensitive and needs human judgement | Keep it as a real-time alert, route it to one owner and add any missing dimensions |
| Merge | Fires alongside other alerts for the same underlying condition | Combine into one condition, keeping each signal as evidence |
| Inform | Useful context, but no one needs to act immediately | Move it to a dashboard, shift summary or daily digest |
| Automate | The response is routine, low-risk and rule-based | Let the system handle it within pre-approved rules and report the outcome |
| Retire | Nobody acts on it and nothing is lost when it is ignored | Switch it off and record why |
Where emite fits
The five dimensions draw on data that rarely sits in one place: history and forecasts for expected behaviour, service and customer data for impact, workforce and policy data for actionability. emite Advanced iPaaS connects those sources, and Advanced Analytics applies consistent baselines and business measures, so each dimension is assessed on the same footing across teams.
AskEmite adds anomaly awareness with contextual explanations, helping teams spend their attention on fewer, better signals and ask follow-up questions in plain language when something changes. Your data answers back.
The key takeaway
Thresholds tell an operation that something moved. Intelligent alerting tells it whether the movement matters, why, how much time remains and what can be done. The goal is to make each alert more useful, so that the alerts people receive are the ones worth their attention.
The next generation of alerts will be measured by the decisions they improve.
References
- Gartner, Gartner Announces the Top Data & Analytics Predictions, 17 June 2025. Read the source
- Joshi, A., Gormley, N., Gadgil, R., Vajiac, C., Townes, T., Rosenfeld, R. and Wilder, B., Reducing Alert Fatigue Through AI Ranking: A Deployed Public Health Data Monitoring System, Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40 (IAAI track), March 2026. Read the source
- Google, Site Reliability Engineering, Chapter 6: Monitoring Distributed Systems. Read the source
