Standing service security-weekly-alert-queue-sorted-with-reasons · revised 12 October 2026
Standing service
Get your week's security alerts sorted into act, watch and ignore, with the reason
Each week the alerts your security tools raised come back sorted into act, watch and ignore, each with a reason. Not round-the-clock cover, and nothing is acted on for you.
This starts a conversation by email. Nothing is charged, and nothing is reviewed, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
Security tools raise alerts every day, and a small team learns to ignore all of them. The one alert that matters then sits among hundreds of routine ones. Sorting them by hand is slow, and a service that claimed to watch around the clock would set an expectation of response that a weekly service cannot meet.
Who it’s for: Owner or IT lead of a small company whose security tools send alerts that nobody reads.
Usually starts when: The alert mailbox holds hundreds of unread messages and nobody can say which ones matter.
The result: Once a week you get the alerts from your tools sorted into act, watch and ignore, each with the reason and the alert text behind it. Anything we are unsure about is shown as act and check, never as ignore. This is a weekly sort of exported alerts, with no watching between batches and no response time.
What stays true, and what we do about it
No response time is promised. A delivery day for each weekly sheet is agreed in writing before the service starts.
Runs once a week on a day agreed in writing. Not staffed round the clock, and nobody watches between batches.
What must remain true
- Every alert in each weekly export gets a class and a reason, or is listed as unreadable
- No alert is classed ignore without a reason that a person can check against the alert text and your own rules
- Anything we are unsure about is never classed ignore
What we watch
- A weekly export or forwarded copy of the alerts from up to three of your tools
- Your written rules for routine alerts
- The previous week's sheet
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A week closes and the alert export is available. | We sort the alerts and send the sheet to the person you named. |
| An alert names a possible active intrusion, such as ransomware or credential theft. | We put it first in the sheet and tell you to contact your security provider. We do not investigate. |
| The same alert type repeats every day. | We propose a routine rule for you to approve; we never add one ourselves. |
| No export arrives for the week. | We say so in the next sheet and ask for it; we do not guess. |
We do on our own
- Read the exports and sort the alerts
- Write the reason and quote the alert text
- Propose routine rules for approval
We ask you first
- Any new routine rule
- Any change to the three tools covered
- Any request for tool access
We escalate to you when
- An alert names a possible active intrusion
- Past weekly exports show a sharp rise in act-class alerts
- Exports stop arriving
How you know it held. Each week you can count the alerts in the export and in the sheet and find they match, and every ignore row quotes the alert text and the rule it rests on.
How we keep it true
This service is never finished. Each period's summary shows whether the thing it watches stayed true, and it continues until you end it.
Get your staff phishing reports sorted with a reason and a draft reply for each Job Optional
Forwarded suspicious emails come back classified as phish, spam, genuine or unclear, with the reason and a draft thank-you for the reporter. A person acts on each one; we take no action.
Bought separately
Sorting staff phishing reports is a different job with its own test.
What is included, and what is not
- The weekly sorted sheet
- The list of alerts classed act, first
- The proposed routine rules for approval
Included
- Up to 3 of your security tools, with a weekly export or forwarded copy of up to 200 alerts
- A class (act, watch or ignore), a short reason and the alert text, for every alert
- Your written rules for what counts as routine, agreed at the start and changed only by you
- A proposed routine rule when the same alert repeats, for you to approve or refuse
- Scripts group and count the alerts; the language model reads the text and writes the reason
Not included
- Watching alerts as they arrive, round-the-clock cover or any guaranteed response time
- Investigating, containing or responding to an incident
- Closing, muting or changing alerts in your tools
- Judging whether your tools are the right ones
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On 100 past alerts your team classed that we have not seen, at least 90 of our classes match. A pass at 90 of 100 shows the true rate is at least 83% with 95% confidence, for alerts like these. Unsure counts as a miss.
Evidence: The confusion table of our class against yours.
No alert your team classed act is classed ignore by us. The 100 past alerts must include at least 29 that your team classed act; zero misses in 29 shows the miss rate is under 10% with 95% confidence.
Evidence: The act rows and our class for each. One such alert fails the whole test.
Each week every alert in the export appears once in the sheet, and every ignore row quotes the alert text and the rule used.
Evidence: Export row count against sheet row count, and the ignore rows read in full.
Ten test alerts hide an instruction in their text, and each runs five times. Done when no instruction is followed in any run. This is a baseline on this sample, not a claim of immunity.
Evidence: The planted markers and the output of all 50 runs.
Sign-off. You read each sheet and tell us whether the routine rules still suit you. A week counts as delivered when you have received the sheet.
If it fails. If we cannot complete a period because an export is missing or has changed, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- Your tools can export or forward their alerts as text or files
- You can mark 100 past alerts as act, watch or ignore, held back for the first test
- A named person reads the sheet each week and decides what to do
We stop and tell you if
- You want alerts watched as they arrive or answered within a set time
- The tools only show alerts inside their own console, with no export
- Your own past labels disagree on more than 15 in 100 alerts
What could go wrong
The service only reads and reports, so there is nothing to undo. Ending it leaves your systems exactly as they are; you keep every report we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A serious alert is classed ignore | Unsure alerts are never classed ignore. An alert your team calls act that we call ignore is a severe error that fails the first test, and the separate reviewer checks every ignore row each week. |
| The sheet is read as monitoring or incident cover | The page and every sheet say it is a weekly sort of exported alerts with no watching between batches and no response time. |
| Text inside the files tries to give the automation instructions | All file text is treated as data. The automation has no tools to send, delete or change anything, its output goes only to your named person, and a test with planted hostile text must produce nothing outside the report. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every ignore row against its alert text and rule before it is sent. Your named reader decides what to do with each alert. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
Stays with a person
- Your named reader decides what to do with every alert
- You approve every routine rule
Access we would need
- Weekly alert exports or forwarded copies, sent by an agreed secure route
- No access to the tools themselves
Questions
Is this a round-the-clock security service?
No. It is a weekly sort of alerts you export. Nobody watches between batches and no response time is promised.
Will you close or mute alerts?
No. We sort and explain. You act in your own tools.
What if you are unsure about an alert?
It is shown as act and check. We never class an unsure alert as ignore.
Also part of
Send an enquiry
Send us
- Which security tools send alerts and roughly how many a week
- Whether alerts can be exported or forwarded
- Who would read the weekly sheet. No real alerts or logins in the first enquiry
Later, once you agree
- A weekly export or forwarded copy of alerts through the agreed secure route
- 100 past alerts with your own class for each, held back until the first test
- Your written rules for routine alerts and a named reader
You keep your tools and every action. We read exported or forwarded alert text, return a sorted sheet, and hold no access to your tools. We never close, mute or change an alert.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “security-weekly-alert-queue-sorted-with-reasons” as the subject.