Eight were rated high.
The usual reaction is panic or indifference. We did something else: we measured each alert against what we actually have running.
Our agents checked all fourteen against the real database: how many users there are, which workflows are active, which components each one uses. The result:
1. Only one truly exposed us that day.
2. Another depended on a connector that had been tried once and had seen no traffic in thirty days.
3. The rest required features we don't use.
That's where human judgment came in. The connector nobody used was switched off that same day. It's the cheapest surface to close. And even though only one alert applied to us, we decided to upgrade anyway.
The agents prepared the upgrade:
1. Twelve database changes reviewed one by one.
2. A full backup, restored into a copy to prove it worked.
3. A rollback plan ready to go.
The outage lasted under two minutes, with zero executions in flight and the same workflows and credentials as before, verified one by one.
We also found a gap of our own: our filter only let high alerts through, and the four medium ones never reached the channel. Filters get reviewed too.
What we now apply on every infrastructure we run:
1. An alert is measured against what runs, not against its label.
2. What isn't used gets switched off.
3. You upgrade anyway, with a backup rehearsed beforehand.
4. Alert filters get audited like any other system.
Fourteen alerts are not fourteen fires. But you have to look at all fourteen to know which one is the fire.