Geopolitical Early Warning Fails at the Threshold, Not the Signal

TL;DR: Most geopolitical early warning systems are judged on whether they catch the rare real signal. The more common and more fixable failure is a threshold set without regard for the team that has to read the output: tuned wide, it drowns analysts in false positives until they quietly stop opening the queue; tuned narrow, it misses what it exists to catch.

Key takeaways:

• A 2025 study built on RAND survey data found one in six Americans has opted out of at least one category of wireless emergency alert, reaching 25 to 30 percent in Texas, driven mainly by alert frequency and irrelevance rather than doubt about accuracy.[^1]
• A June 2026 survey of more than 400 senior risk and compliance leaders found close to a third see monthly false positive rates of 20 to 30 percent in sanctions and watchlist screening, and industry benchmarks put AML alert-level false positive rates as high as 85 to 95 percent.[^2][^3]
• A 2021 survey of 300 US security operations centers found more than a third of analysts and managers ignore threat alerts outright once the review queue fills up.[^4]
• Peer-reviewed research on tornado warnings found perceived false alarm rates do not predict weaker public response, which undercuts the assumption that over-warning mainly erodes trust rather than capacity.[^5]

One in six Americans has switched off at least one category of wireless emergency alert on their phone, according to a 2025 study built on national RAND survey data. In Texas, where alerts have run more frequently, close to a third of respondents had opted out entirely.[^1] The alerts did not stop being accurate. People stopped listening to them.

The Calibration Problem Inside Every Early Warning System

A geopolitical risk monitoring system faces the same design choice as a phone's emergency alert network. Set the trigger wide and it catches almost everything real, at the cost of also catching almost everything irrelevant. Set it narrow and the noise drops, but so does the chance that the one warning that mattered ever gets generated. Nobody solves this by wanting harder. The tradeoff is structural, and it shows up wherever a system tries to flag a rare event inside a much larger stream of ordinary activity.

• Sanctions and watchlist screening runs hot by design. The LSEG survey found close to a third of risk and compliance leaders see monthly false positive rates of 20 to 30 percent, and industry benchmarking puts alert-level false positive rates in AML screening as high as 85 to 95 percent.[^2][^3]
• Security teams already quietly stop responding. The IDC survey found more than a third of analysts and managers ignore threat alerts outright once the review queue is full, with false positive rates running 45 percent in in-house teams and 53 percent among managed providers.[^4]
• Public warning systems show the same pattern from the other direction. Nationally, roughly three in four US tornado warnings are false alarms, a rate that has held for years without collapsing public trust in the warnings that matter.[^5]
• The failure mode that actually shows up is disengagement, not disbelief. The wireless alert study found the main driver of opting out was not doubt about accuracy. It was frequency, irrelevance and disruption, the same three complaints a risk team makes about a platform that pings on every headline.[^1]

Why Tuning for Recall Breaks the Team That Reads the Output

The instinct when a warning system misses something big is to lower the bar, so nothing like it slips through again. That is usually the wrong fix, because it ignores what happens to the humans on the other end of the alert. Attention is a fixed resource inside a company the same way analyst headcount is a fixed resource inside a bank's compliance function. A system tuned to maximize recall generates more alerts than any team can individually review, and a team facing more alerts than it can review does not review all of them evenly. It starts sampling, then it starts skimming, then a fraction of the queue stops getting opened at all, which is exactly the behavior the IDC survey measured directly rather than inferred.[^4]

The tornado warning data complicates the popular version of this story, the idea that people simply become desensitized to warnings the more often they turn out to be false. The 2019 study found perceived false alarm rates did not predict lower rates of protective action, and in some cases correlated with more caution, not less.[^5] What degrades is not trust in the content of the warning. It is willingness to keep the channel open at all, which is a capacity problem before it is a psychological one. A corporate geopolitical risk desk that gets flooded with low-value alerts from a monitoring platform does not stop believing geopolitical risk is real. It mutes the platform, or routes it to a folder nobody opens, which produces the same practical outcome as a missed signal without ever showing up as one on an audit of the system's accuracy.

Setting a Threshold a Strategic Adversary Cannot Game

What the record shows: every case above involves a source that either does not adapt to the warning system, weather, ordinary transaction volume, or adapts to it slowly. Geopolitical risk usually does not work that way. A sanctioned network, a state actor probing export control enforcement, or a counterparty managing its own disclosure timing has a reason to behave differently once it learns how a monitoring system responds, which turns the calibration problem from a fixed statistical tradeoff into a moving one.¹

What we infer: a 2020 game-theoretic analysis of warning systems facing a strategic, adaptive source found something that cuts against the instinct to always minimize false alarms. Where the source can time its own action to exploit a reviewer's fatigue, a warning system calibrated to occasionally overstate a threat can produce better outcomes than one calibrated purely for accuracy, because it forces steadier defensive posture rather than one that relaxes the moment the alert count drops.¹ That is not a license to over-alert. It is a reason to treat the threshold as a decision made in view of who or what is generating the underlying signal, not a single number copied from a vendor's default configuration.

What we recommend: score a monitoring system on what a team actually acted on last quarter, not on how many alerts it generated or how few it missed in hindsight. A system with a lower headline recall that a team reads in full is worth more than one with a higher recall that gets triaged into a queue nobody clears. Set the threshold with the reviewer's actual capacity as an input, review it against real cases handled rather than a vendor's tuning defaults, and treat a sudden quiet period the same way a compliance desk should treat one: as a finding to check, not a quarter to leave blank.

Fortius Intel note: Here is the number almost no monitoring vendor publishes: of everything the system flagged last quarter, how many alerts did a person actually open past the subject line? Until a risk team can answer that, "we get warned early" and "we get warned often" are being treated as the same claim.

This analysis draws on LSEG Risk Intelligence's 2026 Global Survey Report on Screening Data, Facctum's 2026 State of False Positives in AML Screening report, a 2021 IDC and FireEye survey of US security operations centers, peer-reviewed tornado-warning research published in Weather, Climate, and Society, Sutton and Wood's 2025 study of wireless emergency alert opt-out behavior, and Kolb and Conitzer's game-theoretic analysis of strategic warning systems.

---

Footnotes

1. Aaron Kolb and Vincent Conitzer, "Crying about a Strategic Wolf: A Theory of Crime and Warning," June 8, 2020, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2863907 (retrieved September 9, 2026). Source for: the game-theoretic finding that against a strategic, adaptive adversary, a warning system calibrated to sometimes overstate a threat can produce more consistent defensive behavior than one calibrated purely to minimize false alarms. ↩ ↩²