Compared with what, exactly.

Fictional scenarios and synthetic data. Reviewed 6 November 2026.

The Brightwater Tickets dashboard turns amber at 10:40 on a Saturday: declines are 37 per cent above average. Tomas is about to tighten a rule. At 03:30 the following Tuesday the same dashboard stays green, because declines are below average. Ines will later point out that the Saturday was nothing and the Tuesday was the real one.

What is actually being decided.

Spike detection is a comparison, and the decision is what to compare with. Every alert is a claim of the form "this number is unusual". Unusual is only meaningful against a baseline, and most dashboards choose the baseline by accident: the average of everything, or the previous hour, or whatever the chart tool defaults to.

The merchant carries the consequences of a false alarm (a rule tightened during its own on-sale) and of a missed one (a night of card testing that becomes a month of disputes). The analyst carries the choice of baseline, and that choice decides more alerts than any threshold does.

Build the baseline from the same slot.

Traffic at a ticketing merchant is not flat. Saturday mornings carry on-sales; Tuesday at three in the morning carries almost nothing. A single average across all 168 hours of the week describes none of them. The baseline that works is the one built from the same weekday and the same hour, over the last several weeks.

In this illustration, Brightwater's declines across all hours average 120 an hour. For Saturday 10:00 to 11:00 over the last eight weeks, the counts were 140, 155, 162, 148, 170, 133, 158 and 150. The sum is 1,216, so the mean is 152. For Tuesday 03:00 to 04:00 over the same eight weeks: 8, 11, 6, 9, 12, 7, 10 and 9. The sum is 72, so the mean is 9.

Against the all-hours average, 165 Saturday declines look like a 37 per cent rise and 96 Tuesday declines look like a 20 per cent fall. Against the right slot, 165 is 9 per cent above a Saturday morning and 96 is more than ten times a Tuesday night. The dashboard had the colours the wrong way round.

Say the z-score in words.

A z-score is the distance from the baseline mean measured in standard deviations: how many normal wobbles away from normal this number sits. One wobble is routine. Two is worth a look. Many is not routine at all.

The Saturday slot's eight values differ from their mean of 152 by −12, 3, 10, −4, 18, −19, 6 and −2. Squaring and adding gives 994; dividing by the seven degrees of freedom gives about 142, and the square root is about 12. So a normal Saturday morning wobbles by about 12 declines. An observed 165 is (165 − 152) / 12, which is roughly 1.1 wobbles out. Nothing.

The Tuesday slot's values differ from their mean of 9 by −1, 2, −3, 0, 3, −2, 1 and 0. Squares add to 28, divided by seven is 4, square root 2. A normal Tuesday night wobbles by about 2 declines. An observed 96 is (96 − 9) / 2, about 43 wobbles out. That is not a wobble.

The alternative we keep alive: a standard deviation built from eight small numbers is itself unstable. When the baseline mean is in single figures, the plainer ratio to baseline says the same thing more honestly: 96 / 9 is about 10.7 times a normal Tuesday night, and nobody needs a square root to see it. Use the z-score where the baseline is large and the ratio where it is small, and say which one you used.

Keep the denominator in the room.

A count of declines rises when fraud rises. It also rises when sales rise, because more attempts produce more declines at the same rate. The number that separates the two is the decline rate: declines over attempts.

On the Saturday, the 165 declines came from 5,500 attempts, a rate of 3.0 per cent. The eight-week Saturday-morning baseline is 152 declines from an average of 5,070 attempts, also 3.0 per cent. Volume rose with an on-sale; the rate did not move. On the Tuesday, 96 declines came from 130 attempts, a rate of 74 per cent, against a baseline of 9 from 240, under 4 per cent. Volume fell and the rate went through the roof. OWASP’s automated-threat descriptions describes this shape, a burst of attempts with an unusually high decline rate at a quiet hour, as a common signature; we cite it for the shape and build the numbers ourselves.

Report both the count and the rate, in some cases. A count without a denominator is the most common way a true spike hides and a false one shows. The Volume 02 study the-missing-denominator is three rounds of exactly this.

Seasonality, events and drift.

Weekday and hour capture most of the regular shape. Three things break it. Known events: an on-sale, a bonus launch at Lagoon Casino, a month-end at Meridian FX. Put these on a calendar the baseline can see, and compare an on-sale hour with previous on-sale hours, not with ordinary Saturdays. Known incidents: the Tuesday above must be excluded from the next eight weeks' baseline, or the baseline learns that Tuesday nights have 96 declines and the next attack hides inside it. Drift: the merchant grows, the mix of countries changes, an issuer changes its behaviour. A trailing window of the last eight same-slots follows slow drift on its own; a baseline fixed in January does not.

A failure mode to watch.

The baseline is the all-time average, the alert is on the count alone, and the first thing the team does when a spike appears is add it to the baseline by doing nothing about the baseline. Within a quarter the merchant's normal has absorbed two attacks and an on-sale, the alert threshold sits above all three, and the dashboard is green through the next one. A rule is a claim says a silent rule is a finding; a baseline that has quietly grown is the same finding in a different place.

A way to work it.

1. Pick the three series you alert on most (declines, authorisation attempts, refunds are common). For each, store counts and the denominator per hour.
2. For every weekday-hour slot, keep the last eight values. Compute the mean and the standard deviation, or just the mean if it is under about 20.
3. Alert on the z-score when the baseline is large and on the ratio when it is small. Write the threshold in words on the alert: "more than three wobbles" or "more than three times normal".
4. Put the rate beside the count on the same panel. Read the rate first.
5. Maintain an event calendar and an incident list. Both are exclusions from the baseline window.
6. Once a month, look at each slot's baseline over time. If it has climbed, ask what it absorbed.

Take it to the desk.

When our dashboard says a number is up, up against what, and did anyone choose that comparison on purpose?

Try it: A dispute spike that may not be one Look up: baseline · drift · cohort

The Volume 01 study Quiet queue asks what a falling number means, which is this article run in reverse. When the Tuesday comes, The first fifteen minutes is what to do, and A thousand cards, one question is what you are probably looking at.

Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.

Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.