How Risk Signals Are Evaluated

Risk signals in imper.ai are inputs to a broader decision and response workflow. This article explains how signals contribute to incidents and how remediation actions are applied.

In this article

• Signals versus incidents

• Automated remediation

• Manual remediation

• Channel-specific actions

Signals versus incidents

A risk signal represents a single observed indicator. An incident represents a meaningful security event derived from correlated signals and risk scoring.

Not every signal results in an incident. Incidents are created when policy thresholds are crossed or when risk patterns indicate active threat behavior.

Automated remediation

imper.ai supports automated remediation actions that trigger immediately when defined risk thresholds are exceeded.

Examples include:

• Automatically terminating a live meeting

• Blocking a user from continuing a chat or call

• Preventing completion of a sensitive helpdesk workflow

Manual remediation

In manual workflows, imper.ai surfaces risk context to operators or analysts, allowing a human decision before action is taken.

This “human-in-the-loop” model is commonly used in helpdesk and investigation scenarios.

Channel-specific actions

Remediation actions are executed natively within each channel:

• Meeting platforms use actions such as ending or removing participants

• Helpdesk workflows may suspend or block sensitive requests

• Chat environments may restrict message delivery or participation