Field notes
What a false positive actually costs you
Every alert nobody trusts is a shift spent scrubbing footage. A short accounting of what a noisy model does to a security team, and the two numbers worth watching.
AI in the real worldKey takeaways
- A noisy model does not cost you compute, it costs you the shift that stops checking.
- Two numbers matter: alerts per operator per hour, and the share of them anybody acted on.
- Raising the confidence threshold hides the problem and loses the incidents you bought the system for.
- Tune against a written log of real footage, not against how busy the console feels.
A model that cries wolf is not a technical problem for long. It becomes a staffing problem, then a trust problem, and by the time anybody writes it down as either, the console has been minimised on every screen in the room for a month.
What a false positive actually costs
The direct cost is easy and small: someone opens a clip, watches eleven seconds of it, and closes it. The indirect cost is the one that ends deployments. Every clip that turns out to be a forklift's shadow teaches the operator that the next alert is probably a shadow too, and that lesson is learned far faster than it is unlearned.
The two numbers worth watching
Precision and recall are the right idea and the wrong unit, neither of them is a thing a shift supervisor can feel. These two are.
| Measure | Healthy | What it tells you |
|---|---|---|
| Alerts per operator per hour | Under 12 | Whether the console is workable at all |
| Share acted on | Above 60% | Whether the alerts are worth working |
| Time to open | Under 60s | Whether the room still believes the system |
Watch them together. A quiet console with a five per cent action rate is not a tuned model, it is a model that has been turned down until it stopped saying anything.
What not to do about it
The fastest fix is to raise the confidence threshold, and it works on the dashboard immediately. It also removes precisely the marginal detections, the partially occluded, the badly lit, the half out of frame, that the system was bought to catch, because those are the ones a human standing there would have missed too.
- Fix the zone before you touch the threshold; most noise is geometry, not the model.
- Separate the camera from the model in the log, or one bad angle condemns both.
- Give every suppression an author and a date, so it can be argued with later.
Tuning against a log, not a feeling
Pull a week of real footage from the site, score against it, and write down the result before and after every change. A pass/fail log is the only version of this argument that survives a handover, and it turns tuning from an opinion into a diff.
If you cannot say which change moved which number, you have not tuned anything, you have rearranged it.
Frequently asked
Is there an acceptable false positive rate?
Not as an absolute. The workable version is per operator: how many alerts one person can triage in an hour and still open the last one as carefully as the first.
Should suppressed alerts still be recorded?
Yes, and separately from the ones that surfaced. A suppression you cannot audit is indistinguishable from a failure, which is a bad conversation to have after an incident.
Keep reading
All articles
Deployment
Adding AI to cameras you already own
A walkthrough of connecting existing recorders over RTSP, what bandwidth to expect per site, and where a rip and replace is still the honest answer.
Read article
Platform
Scoring a model before it sees a live camera
How a compliance score is built from real footage, and why a pass/fail log beats a confidence average.
Read article
Field notes
Drawing zones that survive a shift change
Zones drawn around today's layout break by Friday. Six rules for defining them on the floor plan so they hold when the yard moves.
Read article
