Use both, split by urgency. Send a real-time alert for a short list of conditions, such as a known-exploited vulnerability in something you run. Send everything else in a weekly digest grouped by owner. If everything pages, people stop reading, and then the real alert gets lost.
The trade off
Real-time alerts shorten the time to react but cost attention. A digest saves attention but delays awareness by up to a week. The right mix depends on what a delay costs.
GitHub's alert model shows the same split. Dependabot alerts email watchers by default, and users can opt into a weekly email digest instead (about Dependabot alerts). The Dependabot documentation also mentions auto triage rules that can dismiss low risk alerts before notifications go out.
Decision table
| Condition | Channel | Why |
|---|---|---|
| Listed as known exploited and present in production | Immediate page | Exploitation is evidenced |
| Critical, reachable, fix available | Same day message | Likely worth fixing now |
| Critical, not reachable | Ticket | Real but less urgent |
| High or medium with a fix | Weekly digest | Planned work |
| Low severity or dev only dependency | Monthly review | Rarely changes decisions |
| Finding re-opened after a fix | Message to owner | Something regressed |
The CISA KEV catalog is a useful input for the first row, since it lists vulnerabilities with a due date for action.
Steps
- Write the urgent list. Keep it to three or four conditions, in plain language.
- Assign a channel per row. Pages to on call, messages to a team channel, digests to email.
- Make the digest useful. Group by owner, sort by risk, show age, and say what changed since last week.
- Count the volume. If the urgent channel gets more than a handful per week, tighten the rules.
- Review monthly. Ask whether any digest item should have been urgent, or any urgent item was noise.
A note on ownership
Alerts need a name next to them. A channel with 40 people and no owner is read by nobody. Map each repository to a team and route accordingly.
What to avoid
- Paging for severity alone. A critical score on unreachable code is not an emergency.
- Sending a daily full list. It is the weekly digest, only more annoying.
- Alert rules that nobody can explain. Write down why each row exists.
For the mechanics of alerting only on changes, see how to stop nightly scans repeating the same alerts.
Quick check
How many urgent conditions is too many?
If people stop acknowledging pages, you have too many. Start with three or four.
Can the digest replace tickets?
No. A digest informs. Work that needs a deadline belongs in a tracked ticket with an owner.
Sources
Last reviewed: 19 October 2026.
