The real cost of alert fatigue when you are the only tech on call

We've argued elsewhere that alert fatigue is an architecture failure, not a discipline failure — that no team can triage hundreds of undifferentiated alerts a day, so a pipeline that produces them is broken regardless of how careful the humans reading it are. That argument gets sharper, not softer, when there is only one human reading it.

A mid-sized MSP can absorb noisy monitoring by throwing more eyes at it — a NOC shift, a triage rotation, someone whose whole job is reading the alert channel. A one- or two-person shop has none of that. Every unnecessary alert is a direct tax on the only person who can also bill hours, close tickets, and answer the phone.

What the noise actually costs you, specifically

• Context-switch cost: every alert you open and dismiss costs the ten minutes it takes to get back into whatever you were doing before it interrupted you — not just the seconds it took to read it.
• Trust decay: once you've dismissed the same false-positive alert twenty times, you stop reading the two-hundredth one carefully, which is exactly when a real one hides inside it.
• After-hours erosion: with no second tech to hand a pager to, noisy alerting doesn't just cost work hours, it costs the evenings and weekends that are supposed to be off.

A triage method that doesn't require a team

• Start from client impact, not device metric — a CPU spike on a workstation and the same spike on the one server running the line-of-business app are not the same alert, even if the threshold that fired is identical.
• Retune thresholds per client, not once globally at onboarding — a threshold that made sense for a five-person office is wrong for a fifty-person one, and neither is a "set once, forget forever" setting.
• Batch the reviewable, page the urgent — decide explicitly which alert classes can wait for a daily review pass and which ones justify interrupting you right now, and hold that line even when it's tempting to page yourself for everything "just in case."
• Kill anything you've muted three times without acting on it — a recurring alert nobody acts on is not being ignored through discipline, it's telling you the threshold is wrong.

At a fifty-person MSP, alert noise is inefficient. At a two-person MSP, it is the difference between a manageable week and an unmanageable one.

This is also exactly the case for wanting monitoring, ticketing, and the AI layer that correlates them to be one system rather than three — a solo operator has the least slack of anyone to spend re-deriving context an integrated platform could have surfaced automatically. That correlation and drafting is the direction the agentic layer in Nexus is built toward; the roadmap page tracks honestly how much of it is live today versus still being built.