According to the SEC, an internal system generated 97 automated emails identifying the problem before the market opened on 1 August 2012, and Knight Capital did not act on them. The lesson is that an alert sent to a mailbox is not an alert that anyone owns, and it applies to security and operations equally.
What the SEC recorded
The SEC's press release on the Knight settlement notes the 97 emails alongside its broader finding that Knight lacked adequate safeguards on market access. When trading began, the router sent over 4 million orders in 45 minutes and the firm lost more than 460 million dollars.
The press release does not say who received the emails or why they went unread, so avoid guessing. What it does establish is that the signal existed before the damage.
Why email alerts fail
Email is a poor channel for urgent signals for ordinary reasons. It mixes urgent and routine mail, it has no acknowledgement, and it assumes the right person is awake and looking. A message sent to a shared mailbox belongs to everyone, which in practice means no one.
An alert checklist
For each alert that could signal customer or financial harm, answer five questions:
- Who is the named owner, and who is the backup?
- How do they receive it, and does it wake them if needed?
- How is receipt acknowledged, and what happens if nobody does?
- What is the first action, and who may take it without asking?
- How do we test that this path still works?
If any answer is blank, the alert is a log entry.
Tune for signal
Teams ignore alerts when most are noise. Count how many alerts in the last month needed action. If the number is low, remove or lower the rest, so that the ones that remain are believed. An escalation path used for false alarms trains people to wait.
Make some alerts blocking
Some conditions should do more than notify. If a pre open health check shows a version mismatch, the system should refuse to start trading or serving, not send mail. Where a stop is safe, prefer it over a message.
Safeguard's guardrails and policy gates are one way to turn a warning into a control, for example failing a pipeline when a condition is not met. Whether to halt a live business process is a decision for your own risk owners.
A quick audit you can run this week
Pull the last ten alerts that your team ignored or closed without action. For each, write down who received it, how, and why it did not lead to work. You will usually find the same two causes: no named owner, or too much noise. Fix those two and the next serious alert has a better chance of being read. Record the result so you can show improvement over time.
Quick check
Does the SEC say who read the 97 emails?
No. The press release states they were generated and not acted on, without naming recipients.
Should every alert page someone?
No. Page only for conditions that need action now, and send the rest to a queue reviewed on a schedule.
Sources
Last reviewed: 19 October 2026.
