# How do I know my security monitoring is actually working?

**Because a page built from events cannot tell you the one thing you need.** A detector that has been silent for a month looks exactly like a detector that is broken or was never switched on. "Nothing happened" and "nothing could have been seen" are opposite states, and an event list renders both as an empty row.

**Build the page from a registry, not from the events.** Keep a list of every detector you run: what it watches, what it does when it fires (record only, notify quietly, ring the phone), and where its rows go. Generate the status page FROM that registry so every detector appears with its count, **including zero**. That also surfaces the detectors you forgot you had, which an event-driven page hides completely.

**Show three states differently:** fired, ran and saw nothing, and cannot record. The third is the one worth an alarm, and it is the one an event list can never show you.

**Then set the loudness by outcome, not by category.** Ring the phone when something got THROUGH: a hostile payload served, an outage, a lockdown. Stay quiet when you REFUSED it, because a refused attack is the system working. A phone that rings for every refusal trains you to ignore it, and then it rings for the real one and you ignore that too.

**The test that settles whether any of this is real:** can you say, for each detector, when it last actually ran rather than when it last fired? If the only evidence a detector works is that it once produced a row, you are trusting a number nobody has checked since.

Related: [what to monitor for a small production app](https://www.tigzig.com/agents-faq/what-should-i-monitor-for-a-small-production-app), [why a health check passes while the app is broken](https://www.tigzig.com/agents-faq/why-does-my-health-check-pass-when-my-app-is-broken), and [the monitoring section of the checklist](https://www.tigzig.com/security/monitoring).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/how-do-i-know-my-security-monitoring-is-actually-working
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms