02 December 2025 • Security • By Vedhagiri Prakasam

The False Alarm Budget: Why Noise Is the Real Failure Mode

The worst outcome of a security analytics project is not that it misses an intruder. It is that it works, and nobody looks.

A system generating steady noise trains its users, and what it trains them to do is dismiss without looking. That habit forms in weeks and it does not distinguish between the ninety-nine alerts that were shadows and the one that was a person. At that point you are paying a licence, paying for hardware, and carrying a security posture on paper that has quietly stopped existing.

This is worth treating as a budget rather than a grumble, because a budget can be specified, measured and contracted for.

A guard dismissing a long list of repeated alerts without opening them

Where alert trust goes

What noise costs, in the order the costs appear

Stage	What happens	Cost
Weeks 1–2	Every alert is checked	Guard time, and it is real
Weeks 3–6	Familiar alerts dismissed from the preview	Low — this is arguably healthy triage
Months 2–3	Whole cameras or zones muted "temporarily"	Coverage lost, invisibly
Month 4+	Alerts dismissed in bulk without opening	The system is decorative
Renewal	"AI didn't work for us"	The category is written off internally

The third row is the dangerous one, because it is where the loss becomes invisible. A muted zone looks identical to a quiet zone on any dashboard. Nobody logs that coverage was reduced, nobody un-mutes it, and the site believes it is monitored in a place where it is not.

Setting the budget

The useful unit is alerts per guard per shift, and the threshold is behavioural rather than statistical: how many can a person receive and still open every one. For a single night guard with other duties, a handful per shift is absorbed and reviewed properly. Something arriving every few minutes will not be, regardless of how well-founded each one is.

Consider a hypothetical site with six perimeter cameras and one night guard. Volumes below are illustrative, chosen to show how the arithmetic behaves rather than to describe a typical installation.

Alerts per camera per night	Total per shift	Likely behaviour
1	6	Each one opened and assessed
5	30	Triaged from previews; mostly still read
20	120	One every four minutes — cameras get muted

Note what this reframes. The question is not "is a 95% accurate detector good?" — it is "how many alerts per shift does this configuration produce, and can the person receiving them keep up?" Those are different questions, and only the second one predicts whether the system survives its first quarter.

The two cheap interventions

Most noise is removed by configuration rather than by better models — zones drawn inside the boundary, dwell requirements, class and size filters, schedules that match how the site runs. That is a separate subject and it is covered here.

The second intervention costs nothing and is almost always skipped: attach a snapshot to every alert. A false alarm dismissed in two seconds from a preview image barely erodes trust, while the same false alarm requiring a login and a video scrub is what teaches people to stop looking. The same alert volume can be sustainable or corrosive depending entirely on how long each one takes to dismiss.

How to hold a vendor to it

Ask for expected alerts per camera per night for your site, in writing, after they have seen it — not a detection accuracy figure, which does not constrain volume. Run a logging-only period first and count what would have been sent, because that number is the honest baseline and it costs nothing to obtain. Agree a target volume as an acceptance criterion alongside detection performance. Establish who tunes the system after handover and whether that is chargeable, since noise is discovered in week three and someone has to own it. And require reporting on muted cameras and zones, because silent de-scoping is the failure you most need visibility of.

The honest summary

Treat alert volume as a specified quantity with a budget, not as a symptom to be endured. A modestly accurate system producing a handful of alerts a shift will outperform an excellent one producing a hundred, because the first is read and the second is not. The same logic governs safety monitoring, where the stakes of an ignored alert are higher still — see tuning PPE alerts.

Muscat Tech Solutions builds intrusion detection on the cameras a site already runs, and would rather commission with a logging-only week and an agreed alert budget than hand over something that gets muted by March. To set that up, talk to us.