A strong answer. “Before touching a threshold I'd want to know what the five real ones look like, because tuning without a labelled set is just moving a dial until the number feels better — and the failure mode is that you tune out the thing you were built to catch.

So first, build a ground truth. Take a few months of alerts and label them properly — genuine, explainable, and unclear. That labelling is real work and it is the only thing that lets me say afterwards whether a change was an improvement rather than a reduction.

Then look at what the 395 have in common, because they will cluster. In my experience the big clusters are: market makers, whose whole business is placing and cancelling quotes, so a naive order-to-cancel ratio flags them constantly; algorithmic order slicing, where a parent order legitimately generates many cancels as it re-prices; and one or two participants with an unusual but entirely legitimate style. Each of those wants a different treatment — a market maker with a registered obligation is a different population and should be scored against market-maker norms, not against everyone.

Then improve the signal rather than the threshold. Spoofing is not high cancellation, it is a pattern: large orders placed away from the touch, on one side, cancelled shortly before or after a smaller execution on the other side. If the detector only measures cancellation rate, it is measuring the wrong thing and no threshold will fix it. Adding the directional relationship between the cancelled size and the executed side typically removes most of the noise without removing sensitivity.

Then be explicit about the trade-off, in writing. If I tune to cut false positives by 80%, what is my estimated effect on detection? I would rather present a defensible curve and a chosen operating point than quietly move a number, because in two years a regulator may ask why the threshold is where it is, and ‘it reduced alert volume’ is not an answer that survives.

And I'd measure the analysts, not just the alerts. If 395 of 400 are noise, the real risk is not the workload — it is that people stop looking carefully. Alert fatigue is the actual failure mode here, and it is the argument that gets this work funded.”