What a real-time alert actually looks like
An anonymised example of a real-time alert from the encrypted channel.
The format.
Three lines plus a tag. Line one, what happened. Line two, what it means for your file. Line three, what we recommend doing or not doing. Tag at the end, the confidence score and the teammate's initials. The message is short. The reasoning is on the file if you want to drill in.
An example, with consent.
Anon Standing client, January 2026. Three-line note. 'Look-alike domain registered against the family business name overnight, currently parked.' 'Pattern matches typosquat for credentials-harvest, no content yet.' 'Takedown request filed, registrar notified, suggest watching incoming mail for forged invoices over the next seven days.' Tag: 78, MR. The client read it on the train, replied 'noted'. The domain came down in forty-eight hours.
What we do not do.
We do not send alerts that need follow-up reading. If the alert needs more context, the morning brief is the right channel. If it cannot wait, voice is the right channel. Real-time alerts on the encrypted channel are for moments where the message is enough.