A nurse in intensive care hears roughly a thousand alarms per patient per day. Between 80 and 99% of them mean nothing. In 2014, after patients died in rooms where the monitors beeped correctly the whole time, clinical alarm safety became a critical patient safety goal.

Nobody fixed that by buying louder alarms.

The brand protection industry has now spent years creating the same problem for themselves. Unfortunately, for us, unlike the health industry, we aren’t dealing with a human body that has similar issues to a hundred years ago. The production of brand abuse is automated now. Bots list counterfeits by the thousand per hour, and a generative model can turn out a phishing page, a matching domain and the email driving traffic to it before lunch. The number of alarms is going to go up. But those tasked with monitoring them are still human. So alerts grow at the speed of industrial machines, and the team tasked with answering them grows the way payroll does.

Faced with that, some teams quietly stop reading the notifications, because they cannot tell which ones matter. The more diligent go the other way and tighten the criteria until fewer alerts get through. Or they just try to keep up and drown. No approach answers the problem, because the alerts aren’t the problem. They’re just alerts. There are simply more threats out there.

If this was a neat metaphor, we could perfectly mirror the hospital alarm issue. But it isn’t. In the hospital, there is a problem of too many false alarms. That isn’t what we’re dealing with. That domain really was registered. That listing really is live. You are not drowning in noise. You are drowning in potential threats.

Why monitoring on its own stopped working

Each one of those alerts is an unknown. What monitoring can do is confirm that a domain exists, resolves and has mail configured. But what it can’t do is work out what that means. Is it a lookalike for a site you’re going to launch in two months, or maybe it’s hosting a page identical to your checkout flow? You need to actually check to find that out.

Domain monitoring also rarely talks to social monitoring, which rarely talks to whatever watches the marketplaces. Each identifies and ranks risk inside its own walls, so one coordinated attack shows up as four unremarkable items in four places, none of them urgent on their own.

The issue is that, by design, monitoring is inherently reactive, because it can only report what already exists. A study of 4.8 million phishing victims put the duration of the average campaign at 21 hours, first victim to last, with 63% of people being affected before the attack is detected.

The tempting fix is to add more people to match the growing alerts, but we all understand that even if that would work – and to be clear, with AI help the problem is growing faster than you can possibly hire – it just isn’t a solution you can sell to the accountants.

You need a different approach.

What intelligence-led brand protection actually looks like

If monitoring tells us what exists, intelligence shows us what matters and why.

What it should do is rank threats by danger rather than just highlighting everything that might be a threat. For instance, a lookalike domain with mail records configured, a working login form and a fresh certificate is being prepared for use against your customers. On the other hand, a parked typo is likely just somebody’s passive income stream. A normal monitoring feed rates both on how closely they match your trademark, not on the actual threat they pose.

But that’s not all: good intelligence-led brand protection should be thinking about the context, taking things like the marketing calendar into account. Because a near-miss domain registered three weeks before a product launch is a different type of animal entirely from the same one registered on a slow Tuesday in March.

Finally, intelligence needs to think strategically and see the whole picture. A collection of different alerts could be random, or it could be a pattern predicting a future major attack. Being able to predict which is which can help you focus on what matters. You should have fewer urgent red notifications, and the ones you do get should have details to prepare you for them.

After detection: action

Some problems go away if you ignore them. An unwanted LinkedIn recruiter’s message or that stiff neck after sleeping wrong. It’s great when it happens. You take the path of least resistance and your issues solve themselves. But you know that for real problems, you can’t just ignore them. Real problems require attention and action.

Brand intelligence is the tool you use to work out which problems require attention, and enforcement is the action you apply to solve them.

Unfortunately, as the threats have grown more complicated, the solutions have had to get more sophisticated in turn. And that includes the tools used to handle domain takedowns. Depending on what type of issue (or issues) you’re seeing, the solutions are different.

That’s where experts like our takedown services come in, helping you turn your intelligence into solved problems. Our team is discreet, experienced and able to work with your own legal representation to make threats go away, whether malicious domains, fraudulent websites, counterfeit listings or infringing content.

Closing the loop

In the end, however you set up your brand protection teams, what matters is the results. So, working out how best to use your resources, both in monitoring and in enforcement is vital to keep your brand healthy online. Because you can’t keep jumping at every single alarm, as you’ll end up jumping at none of them.

Hospitals did not solve alarm fatigue by making the machines louder. They did it, and continue to do it, by prioritizing which alarms matter. And with less distracting noise, they can apply their life-saving interventions where it matters most.

That’s where we think brand protection is going, too. Not showing you every threat out there, but knowing which findings would genuinely cost you something, and then acting on them before they cause serious harm. Everything else is beeping.

If your setup is good at telling you what exists and quiet on what to do about it, talk to us about brand monitoring.

Share article