Intelligence Without a Dial Tone: Fixing the Escalation Path Your Feed Never Had

Every security leader has lived some version of the same night. A feed fires at 2:47 a.m. The on-call analyst glances at it, decides it looks like vendor marketing dressed up as an advisory, and swipes it away. Six hours later, the same indicator shows up in an incident ticket—except now it's inside the environment, and the question in the conference room isn't "why did this happen?" It's "why didn't anyone wake me up?"

The uncomfortable answer is that nobody was supposed to be woken up. The intelligence program was built to collect, not to decide. And collection without a decision framework produces exactly the kind of noise that trains your people to ignore the pager.

The Volume Problem Is an Authority Problem

The reflexive fix for alert fatigue is tuning—more filters, tighter thresholds, a better SIEM correlation rule. Tuning helps, but it treats a symptom. The deeper issue is that most feeds have no mapping between a signal and a human with the power to do something about it.

Consider what actually happens when a credible indicator of compromise lands at an average US enterprise: it routes to a shared mailbox or a ticket queue. From there, it competes with every other ticket. The analyst who receives it can enrich it, annotate it, maybe escalate it—but they often can't isolate a host, revoke a token, or block a domain at the edge. Intelligence arrives at the lowest possible rung of the org chart and dies there, waiting for morning.

Contrast that with how a hospital handles a critical lab result. The result doesn't go to a queue. It goes to a named clinician, at any hour, with a defined protocol attached. The difference isn't technology. It's the pre-committed pairing of signal, person, and authority.

Building the Three-Tier Escalation Framework

The framework we recommend to clients is deliberately simple, because complexity at 3 a.m. is its own vulnerability. Every piece of intelligence gets sorted into one of three tiers at the moment it's ingested—not after a human triages it.

Tier 1: Log and Review. These are the bulk of feed volume—stale indicators, low-relevance sector chatter, vendor product announcements. They route to a weekly digest reviewed during business hours. Critically, nothing in this tier is permitted to page anyone. If a Tier 1 item turns out to matter, that's a tuning failure to be addressed in the post-review, not a reason to break the contract with your on-call staff.

Tier 2: Verify Before Sunrise. This tier contains credible, relevant intelligence without a confirmed internal impact—a new ransomware strain targeting your industry, a critical vulnerability in software you run, a supply chain notification from a partner. It goes to the on-call analyst with a four-hour acknowledgment expectation and a defined verification checklist: do we own this asset, is it exposed, is there telemetry suggesting contact? The output of Tier 2 is either a "no action needed" note or a promotion to Tier 3 with evidence attached.

Tier 3: Wake Someone Up. Reserved for indicators with confirmed or near-certain internal relevance—active command-and-control domains observed in your DNS logs, credentials from your domain appearing in a fresh dump, exploitation of an internet-facing system you operate. Tier 3 pages a named individual, not a rotation alias, and that individual holds pre-delegated authority: the ability to pull systems offline, force credential resets, or invoke the incident response retainer without waiting for a morning approval chain.

That last phrase—pre-delegated authority—is where most programs fail. Organizations happily build the paging logic but never have the hard conversation about what the 3 a.m. responder is actually allowed to do. Without that delegation, your escalation path terminates in a person who must, in turn, wake someone else, adding latency to a timeline measured in minutes.

The Human Contract Nobody Writes Down

There's a second, quieter reason escalation frameworks collapse: the people inside them never agreed to the terms. A Tier 3 page is a promise extracted from someone's sleep, and if that promise was assigned rather than negotiated, it will be honored exactly as long as it takes for resentment to curdle into silence.

Formalize the contract. Who holds Tier 3 responsibility this month, and what is the compensating arrangement—comp time, additional pay, a hard rule that a 3 a.m. page buys a late start? What is the expected response window, and what happens if it's missed? What is the escalation path above the Tier 3 responder, and is that person's number actually current in the runbook? We have reviewed incident timelines where the single largest delay was a stale phone number for a VP who had left the company eleven months earlier.

Drilling the Path Before You Need It

An escalation framework that exists only in a Confluence page is a hypothesis, not a control. Test it quarterly with a live-fire exercise: inject a synthetic Tier 3 indicator, page the responder, and time the path from signal to containment action. Measure it the way you'd measure any other operational process.

The results are usually humbling. Median time from page to action in untested organizations routinely exceeds ninety minutes—most of it spent on human navigation, not technical work. After two or three drills, that number typically falls below fifteen. The framework didn't change. The people simply learned where the edges were.

Intelligence That Earns Its Budget

Threat intelligence subscriptions are easy to justify in a renewal meeting and easy to quietly resent everywhere else, because their value is invisible unless something goes wrong. A tiered escalation framework changes that equation. It converts the feed from a research service into an operational trigger, and it gives the board a defensible answer to the question every director eventually asks: "If something happened tonight, who would know, and when?"

Build the tiers. Write down the authority. Drill the path. The 3 a.m. call will still come—but next time, it will go to the one person who can end it.