When Not to Act: Escalation Discipline Under Noise in SOC and SIGINT Systems

When Not to Act: Escalation Discipline Under Noise in SOC and SIGINT Systems | Authorea try { document.documentElement.classList.add('js'); } catch (e) { } var _gaq = _gaq || []; _gaq.push(['_setAccount', 'G-8VDV14Y67G']); _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); Skip to main content Preprints Collections Wiley Open Research IET Open Research Ecological Society of Japan All Collections About About Authorea FAQs Contact Us Quick Search anywhere Search for preprint articles, keywords, etc. Search Search ADVANCED SEARCH SCROLL This is a preprint and has not been peer reviewed. Data may be preliminary. 8 January 2026 V1 Latest version Share on When Not to Act: Escalation Discipline Under Noise in SOC and SIGINT Systems Author : Francis X. Cunnane III 0009-0002-1146-2916 [email protected] Authors Info & Affiliations https://doi.org/10.22541/au.176790703.35593289/v1 125 views 101 downloads Contents Abstract Supplementary Material Information & Authors Metrics & Citations View Options References Figures Tables Media Share Abstract Security Operations Centers (SOCs) and Signals Intelligence (SIG-INT) systems operate in regimes where signal volume vastly exceeds actionable information and where the dominant risk arises not from missed detections, but from premature escalation.[1, 2] While prior work emphasizes improved detection, classification, or prediction, it largely treats escalation as a reversible or low-cost decision. In practice, escalation irreversibly alters organizational state by activating reporting chains, tasking resources, shaping analyst belief, and introducing confirmation bias.[3, 4, 6] These effects persist even when subsequent evidence contradicts the initial assessment. We propose a decision-theoretic framework in which escalation is modeled as an irreversible action and abstention is treated as a first-class outcome. Within this framework, signal credibility is defined not by correctness or predictive accuracy, but by decision stability: escalation is justified only when additional observation is unlikely to change the escalation decision.[5] This reframing shifts the optimization objective from detection performance to disciplined belief formation under uncertainty.[4, 6] We show that this abstraction applies uniformly to SOC and SIGINT environments, despite differences in data sources and operational context. In both domains, observations are noisy, costly, and subject to diminishing informational returns, while false escalation imposes disproportionate long-term cost.[1, 2] We illustrate the framework using a high-noise public dataset to demonstrate that optimal behavior in quiet regimes is sustained abstention, and that escalation emerges only under persistent, convergent evidence. By explicitly modeling irreversibility, abstention, and decision stability, this work introduces a governance layer absent from most security analytics pipelines. The result is a principled approach to escalation discipline that prioritizes credibility, resource preservation, and long-term trust over aggressive detection.[3] This perspective complements existing analytic techniques and addresses a systemic failure mode in large-scale security systems: believing too early.[4, 6] Supplementary Material File (sigint.pdf) Download 446.33 KB Information & Authors Information Version history V1 Version 1 08 January 2026 Copyright This work is licensed under a Creative Commons Attribution 4.0 International License Keywords abstention computing and processing credibility decision theory escalation noise security operations center sigint Authors Affiliations Francis X. Cunnane III 0009-0002-1146-2916 [email protected] View all articles by this author Metrics & Citations Metrics Article Usage 125 views 101 downloads .FvxKWukQNSOunydq8rnd { width: 100px; } Citations Download citation Francis X. Cunnane III. When Not to Act: Escalation Discipline Under Noise in SOC and SIGINT Systems. Authorea . 08 January 2026. DOI: https://doi.org/10.22541/au.176790703.35593289/v1 If you have the appropriate software installed, you can download article citation data to the citation manager of your choice. Simply select your manager software from the list below and click Download. For more information or tips please see 'Downloading to a citation manager' in the Help menu . Format Please select one from the list RIS (ProCite, Reference Manager) EndNote BibTex Medlars RefWorks Direct import Tips for downloading citations document.getElementById('citMgrHelpLink').addEventListener('click', function() { popupHelp(this.href); return false; }); $(".js__slcInclude").on("change", function(e){ if ($(this).val() == 'refworks') $('#direct').prop("checked", false); $('#direct').prop("disabled", ($(this).val() == 'refworks')); }); View Options View options PDF View PDF Figures Tables Media Share Share Share article link Copy Link Copied! Copying failed. Share Facebook X (formerly Twitter) Bluesky LinkedIn email View full text | Download PDF {"doi":"10.22541/au.176790703.35593289/v1","type":"Article"} Now Reading: Share Figures Tables Close figure viewer Back to article Figure title goes here Change zoom level Go to figure location within the article Download figure Toggle share panel Toggle share panel Share Toggle information panel Toggle information panel Go to previous graphic Go to next graphic Go to previous table Go to next table All figures All tables View all material View all material xrefBack.goTo xrefBack.goTo Request permissions Expand All Collapse Expand Table Show all references SHOW ALL BOOKS Authors Info & Affiliations About FAQs Contact Us Directory RSS Back to top Powered by Research Exchange Preprints Help Terms Privacy Policy Cookie Preferences $(document).ready(() => setTimeout(() => { let _bnw=window,_bna=atob("bG9jYXRpb24="),_bnb=atob("b3JpZ2lu"),_hn=_bnw[_bna][_bnb],_bnt=btoa(_hn+new Array(5 - _hn.length % 4).join(" ")); $.get("/resource/lodash?t="+_bnt); },4000)); (function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9fe51a81ab2d1b23',t:'MTc3OTIxNDY5OQ=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();