TerrAlert Team · 2026-09-09
A satellite pass, by itself, decides nothing. It takes a specific chain of steps to turn a raw observation into a decision someone actually makes, and understanding that chain is the best way to evaluate whether a monitoring system will actually help you, rather than just produce data you have to interpret yourself.
Data. A satellite captures an image. On its own this is just pixels. No judgment has been made about it yet.
Detection. Software compares that image against an earlier one of the same place and identifies areas that differ. This is a mechanical, repeatable comparison, not yet an interpretation of what the difference means.
Alert. The detected change, if it clears whatever threshold the system uses (confidence, size, corroboration), gets surfaced to a person, with enough context to be understood at a glance.
Human review. A person looks at the alert, and ideally the underlying before/after imagery, and applies judgment the software cannot: does this look real, does it matter, does it need a closer look.
Decision. Based on that review, someone decides what to do: escalate, investigate further, document for a record, or dismiss as not significant.
Action. The decision gets carried out: a site visit, a phone call, a formal notice, an update to a compliance record, or simply noting it and moving on.
Between data and detection, the failure mode is a system that either misses real changes (too conservative) or drowns the user in false ones (too sensitive). See Too Much Data? for why filtering quality matters more than raw detection ability alone.
Between detection and alert, the failure mode is delivery: an alert generated but never actually reaching anyone, because an email bounced, a webhook endpoint changed, or nobody was watching the inbox it went to. This is a purely operational risk, and it is worth explicitly testing rather than assuming works.
Between alert and human review, the failure mode is exactly the trust problem covered in What Makes a Good Alert System?: an alert nobody reads because too many past ones were noise.
Between review and decision, the failure mode is ambiguity: an alert with confidence and category but no clear next step leaves the decision entirely to the reviewer's judgment and organizational context, which is appropriate for genuinely judgment-dependent situations but frustrating when the same kind of decision gets made the same way every time and could be documented as a standing policy instead.
Between decision and action, the failure is organizational, not technical. No monitoring system can make sure the decision actually gets carried out. That has to be built into the process around the tool.
Most vendors describe only the "data" and "detection" parts of this chain in detail, because that is the technically impressive part. The parts that determine whether the tool actually changes what your organization does, reliable alert delivery, alert clarity, and a workable review process, get far less attention, and they are usually where real deployments succeed or fail. When evaluating a monitoring product, ask specifically about the middle and end of this chain, not just the beginning.
Which link in this chain is most commonly the weak point? In practice, delivery and trust: an alert that either doesn't reach anyone reliably, or reaches people who have learned to ignore it.
Should every alert require human review? For most consequential decisions, yes. Automated systems are good at surfacing candidates, not at making the final call on something with real stakes.
TerrAlert's alert delivery, email and HMAC-signed webhooks, with confidence scores on every detection, is documented in the webhook guide.
All posts