Here’s a version of a story that comes up in almost every conversation we have with fund ops leads. The details change. The shape never does.
A sanctions match lands on a portfolio company’s newly appointed finance lead. Friday, mid-afternoon. It goes into the monitoring channel correctly flagged, correctly sourced, with a link straight to the primary listing. On Monday morning three people scroll past it. All three register it. All three assume the compliance lead has it handled. The compliance lead is on a plane to an LP meeting and doesn’t open the channel until Wednesday, by which point the alert is twenty messages up. It resurfaces eleven days later, when the portfolio company’s bank calls to say the account has been frozen.
Nobody in that chain did anything obviously wrong. The platform worked. It found exactly what it was built to find, on the day it was supposed to find it, and it put a source link right there in the message.
What broke was everything after the message.
Detection was never the hard part
This is the part buyers consistently underweight. Demos focus on detection: how many sources, how fast, how accurate, how much of the noise gets stripped out before a human sees it. Fair enough. Those things matter, and a platform that gets them wrong is worthless.
But we’ve never seen a fund abandon continuous monitoring because the detection was bad. We’ve seen plenty abandon it because the alerts landed somewhere nobody was looking, addressed to nobody in particular, and after six weeks the channel had turned into background noise that everyone had learned to scroll past.
So the question that actually decides whether any of this works isn’t “what will it catch.” It’s “where does this live in our week, and who moves when it fires.”
Four ways an alert dies
Roughly four, anyway. They tend to compound.
Nobody sees it. The alert goes to a shared inbox, or a dashboard, or a channel already carrying three hundred messages a day. It is technically present. Nobody encounters it while it still matters.
Nobody owns it. This is the one from the story above, and by a wide margin it’s the most common. An alert addressed to “the team” is addressed to no one. Incident response literature has a name for this, diffusion of responsibility, and it has been documented in enough postmortems that you’d assume the industry had solved it by now. The industry has not solved it.
The alert doesn’t say what to do. Severity unstated, next action unspecified, the “so what” missing entirely. An operator staring at an ambiguous signal at 4:40 on a Thursday queues it for later. You know how that goes.
Alert fatigue. Volume too high, hit rate too low, and the team quietly learns that ignoring the feed carries no consequence. SANS Institute has written a lot about this in the SOC context and the numbers are grim: analysts routinely triage a small fraction of what reaches them. The dynamic in risk intelligence is identical. Different signals, same human ceiling.
Email is the wrong pipe for anything urgent
Email is where information goes to be found later. That’s a real function, and for a decent chunk of what continuous monitoring produces it’s exactly right.
For anything time-sensitive it’s the wrong pipe. Not because email is somehow inferior, but because of latency. Median response time to a professional email runs into hours. Median response time in a chat channel your team already has open runs into minutes. When a sanctioned entity turns up in a portfolio company’s payment flow, the window in which a response is still useful looks a great deal more like the second number than the first.
It’s worth remembering how quickly the underlying data moves. OFAC’s recent actions feed updates continuously, not on a schedule that suits your inbox habits. Neither does anything else in this category.
Why Telegram, and when it’s the wrong call
For a large share of the companies we work with, that already-open channel is Telegram. This surprises people who have never worked in different industries and surprises nobody who has.
The teams are simply already there. Deal conversations, portfolio comms, founder groups, LP threads. For a ccompanies Telegram isn’t a channel you add on. It’s the channel. Routing alerts into it requires zero behaviour change from the team, and zero behaviour change is the only kind of workflow adoption that survives a busy quarter.
It also crosses organisational boundaries in a way most enterprise tools deliberately don’t. Slack and Teams are internal by design, which is correct for almost everything and inconvenient for this. When an impersonation campaign is running against a portfolio company, the people who need to know include the fund’s ops lead and the founder’s own team. Telegram groups handle that natively.
And delivery holds up internationally. Funds with distributed teams, or portfolio exposure spread across several jurisdictions, hit email delivery problems more often than you’d expect. Regional filtering, corporate spam rules, the usual. Telegram doesn’t have that problem in the same way.
Now the caveat, because it matters more than the pitch. Telegram is not the right channel for every fund. If you’re an institutional shop with an enterprise messaging policy, or your LPs have firm opinions about where fund communications live, route to Slack, Teams or a structured email digest instead and don’t feel bad about it. What matters is that alerts land where your team already looks. Which channel that happens to be depends entirely on your team, not on ours.
Tiering: the boring fix almost nobody does
Most funds we speak to are running their risk feed as one undifferentiated firehose. Everything arrives in one place, at one priority, and the ops lead is expected to sort it out. This works for about three weeks.
The fix is boring. It’s tiering. Three levels is enough, and you can add more, but you probably shouldn’t.
Critical. A sanctions hit. Active fraud signal. Imminent regulatory action. A confirmed breach at a portfolio company. This goes to a push channel with a named human on it. Not a team. A person. Acknowledgement is expected inside four hours, not “when someone gets to it.”
Material. Substantive adverse media, a change in entity status, verified impersonator activity, litigation naming a founder or an officer. Goes to the ops channel, triaged inside the business day.
Informational. Everything worth knowing and not worth interrupting anyone for. Sector regulatory movement, low-relevance media mentions, minor filings. Batched. Delivered Friday, read in ten minutes, done.
The specific tiers don’t matter much. Having tiers at all matters enormously. If you want a shortcut, NIST’s incident handling guide (SP 800-61) formalised this pattern for security teams two decades ago and the logic ports over almost unchanged. Borrow their framework, rename the categories, move on.
Two different jobs, two different outputs
Continuous monitoring answers one question: what’s moved in our portfolio since last week.
There’s a second question funds ask constantly, and it has a completely different shape. Tell me everything you know about this entity, right now, in one document. A new deal in diligence. An LP asking about a specific holding. Annual re-verification. That isn’t a feed. That’s a report, and it needs to be deep, structured and shareable with people who weren’t in the room.
Both matter. Buying a platform that nails one and treats the other as an afterthought is a mistake we watch people make regularly, usually because only the first use case was in the buyer’s head during evaluation and the second one showed up in month two.
Stop making people log in somewhere
Every click between a signal and a decision is a place where the decision doesn’t get made.
Which means the dashboard, however good it is, shouldn’t be the primary surface. It should be where you go when you already know what you’re looking for. The alerts themselves have to arrive inside the tools the team is already sitting in.
For most of the venture funds we work with that looks roughly like this. Signals get pushed into the deal CRM so the risk history is sitting right there the next time someone opens the record. The weekly digest posts into Notion, next to the portfolio review doc, where the team already is on Friday afternoon. Critical alerts spawn a task in whatever the ops team uses to track work, because an alert without an owner and a due date isn’t a task. It’s a note.
The platform detects. Your existing stack tracks. Building a second system of record inside the risk tool is precisely how things get lost.
The ritual is the whole thing
You can design a perfect routing map and it will decay inside eight weeks if nobody ever looks at it deliberately. So the cadence matters as much as the plumbing.
Weekly, thirty minutes, ops lead runs it. Scan the informational digest. Status check on anything that escalated during the week. Write down decisions, including the decision to do nothing, because “we reviewed it and judged it immaterial” is a defensible position and “we never got round to it” is not.
Monthly, go looking for patterns instead of incidents. Three portfolio companies getting impersonated inside the same six weeks isn’t three problems. It’s one, and it’s probably a campaign. Individual alerts almost never tell you this. Thirty days of them, read together, usually do.
Quarterly, and this is the one everyone skips: sit down and ask which alerts actually led to an action and which ones were noise. Then retune the thresholds. The teams whose risk programmes are still alive at eighteen months are, almost without exception, the ones doing this. The programmes that quietly died were running month-one settings in month fourteen.
What we watch teams get wrong
A short list, and I’d bet most funds reading this are doing at least one of them:
- Everything routed into a shared compliance inbox
- Severity thresholds set once during onboarding and never touched again
- Critical alerts delivered by email
- The alert treated as the end of the process rather than the start of one
- The whole workflow built around the platform’s defaults instead of the team’s actual week
All five are fixable in an afternoon. Most teams fix at least one of them around month three, usually a week or two after something slipped through.
Conclusion
Here’s what a working setup actually looks like, and it’s less dramatic than you’d think.
The ops lead knows within minutes when something critical fires. Informational signals stack up into a Friday digest that takes ten minutes to read. Diligence reports show up inside the deal doc, not in a separate portal someone has to remember to open. Nothing escalates twice without getting closed out. And nobody is checking a dashboard just in case, because there’s no reason to.
The end state isn’t a team that uses a risk tool. It’s a team that stops thinking about it, the same way you don’t think about your email working. That’s the bar, and most funds are further from it than they realise.
If you want to build that map against your own stack, Beady AI will walk through it with you. Telegram or Slack, digest cadence, CRM, who owns what. Book a working session and we’ll do it against your real portfolio rather than a demo one.
