# SCADA Alert Engine

*/Opportunities/SCADA_Alert_Engine*

## Opportunity Overview

**Wedge**: The initial wedge targets regional water and wastewater treatment facilities utilizing the Ignition SCADA platform. These facilities face stringent compliance requirements regarding missed alarms and rely on standardized pumping equipment, enabling fast proof of value. From this beachhead, the product expands into food and beverage manufacturing, leveraging the same base integrations for continuous process environments.
**Timing**: Large language models now successfully interpret legacy, unstructured sensor tag naming conventions and historical maintenance logs without manual data mapping. This eliminates the multi-month integration periods previously required for industrial analytics deployments.
**Why This I C P**: Regional municipal utilities and mid-market manufacturers lack the capital for custom systems integration from legacy giants like Siemens or Honeywell. They experience acute operator shortages, making alert fatigue an immediate operational bottleneck rather than a mere inconvenience.
**Size Of Prize**: The United States contains roughly 120,000 mid-sized industrial and municipal facilities operating continuous SCADA systems. Capturing an annual software and labor-offset spend of $30,000 per facility for alarm management produces an addressable market of approximately $3.6 billion.
**Gap Narrative**: SCADA systems generate thousands of raw tag alerts daily, overwhelming operators with nuisance alarms and masking critical equipment failures. Industrial control rooms require an engine that maps raw sensor data to operational context, automatically grouping redundant alerts and prioritizing actual faults. Current alarm management solutions rely on rigid, manually updated rule sets that fail to adapt to changing plant conditions.
**Defensibility**: Defensibility builds through deep workflow lock-in and facility-specific data compounding. As the engine observes how operators clear, acknowledge, or escalate specific alert clusters, it trains a site-specific operational model. The cost of ripping out a system that accurately filters out nuisance alarms and replacing it with an untrained baseline creates high switching friction.
**Why This Thesis**: A software-overlay thesis fits this environment because it avoids the regulatory and operational risks of altering the underlying industrial control system. The software reads state from the SCADA historian and writes recommendations to an isolated operator dashboard, keeping the critical physical control loop secure.

## Opportunity Linked Thesis

**Thesis**: [Software](/Theses/Software)

## Opportunity Linked I C P

**Icp**: [Water Treatment Facility](/CompanyTypes/Water_Treatment_Facility)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$400M-$600M (representing ~25k mid-to-large North American municipal water treatment facilities)
**S O M**: ~$10M-$25M (targeting 500 to 1,250 progressive regional utility districts over 3 years)
**T A M**: ~100k global water and wastewater treatment facilities x ~$15k-$25k/yr ≈ $1.5B-$2.5B
**Growth Rate**: ~8-12%/yr, driven by retiring utility operator workforces and tightening EPA compliance mandates requiring faster anomaly response times
**Paid Comparable Spend**: ~$30k-$60k/yr per facility spent on legacy alarm dialer software, tele-messaging services, and off-hours operator overtime for investigating false positive SCADA alarms

## Opportunity Incumbents

- [WIN-911](/Products/WIN-911) — Tool
- [Inductive Automation Ignition](/Products/Inductive_Automation_Ignition) — Tool
- [Custom Python Scripts](/Products/Custom_Python_Scripts) — DIY
- [PagerDuty](/Products/PagerDuty) — Tool
- [TopView Alarm Management](/Products/TopView_Alarm_Management) — Tool
- [Manual Operator Monitoring](/Products/Manual_Operator_Monitoring) — Service
- [Excel Alarm Logs](/Products/Excel_Alarm_Logs) — Spreadsheet

## Opportunity Win Conditions

**Kill Thresholds**:
- Average deployment time exceeds 14 days
- Alarm volume reduction is less than 30 percent after 30 days
- Conversion rate from pilot to paid is under 25 percent at day 90
- CAC exceeds $15k per facility
**Leading Metrics**:
- Time-to-first-routed-alert (hours)
- False-positive suppression rate (%)
- Operator acknowledgment latency (minutes)
- On-call overtime hours saved per week (hours)
**What Proves Right**: Operators connect the SCADA Alert Engine to their existing historians and configure alert routing logic within 48 hours. The engine intercepts raw tags, suppresses nuisance oscillation alarms, and routes verified anomalies to on-call devices. Facilities convert to paid $15k annual contracts after a 60-day trial based on the measured drop in overtime dispatch costs.
**What Proves Wrong**: Utility IT departments block deployment due to air-gapped SCADA environment constraints, preventing any data ingestion. The engine fails to distinguish between critical equipment failures and normal sensor drift, flooding operators with legacy-level alarm volumes. On-call operators bypass the tool because configuring suppression logic requires specialized programming rather than visual rules.

## Opportunity Build Profile

**Hardest Part**: Reliably normalizing high-velocity telemetry across dozens of legacy, proprietary OT protocols without introducing latency or dropping critical state changes. The reliability bar is absolute because a single missed alert in an industrial environment destroys trust.
**Min Viable Scope**: A read-only passive network tap parsing only Modbus TCP and OPC UA that outputs grouped alerts to an existing SIEM dashboard. Exclude active polling, automatic remediation, and serial protocol support entirely.
**Cold Start Problem**: Plant managers refuse to install unproven software on live industrial networks to gather the baseline telemetry required to train the engine. Break this by securing offline packet captures from a system integrator or utilizing open-source ICS traffic datasets to pre-train the v1.
**Time To First Value**: 2-4 weeks of passive baseline monitoring
**Data Moat Available**: true
**Technical Difficulty**: High

## Neighborhood

### Where the gap lives

- [Agricultural Irrigation District](/CompanyTypes/Agricultural_Irrigation_District) — latent gap · CompanyTypes

### Incumbent in

- [Ignition SCADA](/Products/Ignition_SCADA) — incumbent in · Products
- [Bespoke Python Scripts](/Products/Bespoke_Python_Scripts) — incumbent in · Products
- [PagerDuty](/Software/PagerDuty) — incumbent in · Software
- [Excel Alarm Logs](/Products/Excel_Alarm_Logs) — incumbent in · Products
- [TopView Alarm Management](/Products/TopView_Alarm_Management) — incumbent in · Products
- [WIN-911](/Products/WIN-911) — incumbent in · Products
- [Manual Operator Monitoring](/Products/Manual_Operator_Monitoring) — incumbent in · Products

### Applies thesis

- [Water Treatment Facility](/CompanyTypes/Water_Treatment_Facility) — applies thesis · CompanyTypes

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### Similar Opportunities

- [SCADA Alert Triage Automation](/Opportunities/SCADA_Alert_Triage_Automation) — similar · Opportunities
- [SCADA Alert Triage Automation](/Industries/Utilities/CompanyTypes/Municipal_Water_and_Wastewater_Utility/Opportunities/SCADA_Alert_Triage_Automation) — similar · Opportunities
- [Alarm Flood Triage](/Opportunities/Alarm_Flood_Triage) — similar · Opportunities
- [SCADA Fault Diagnostics](/Opportunities/SCADA_Fault_Diagnostics) — similar · Opportunities
- [Substation Alarm Hysteresis Optimization](/Opportunities/Substation_Alarm_Hysteresis_Optimization) — similar · Opportunities
- [Predictive Alert Routing for Utilities](/Opportunities/Predictive_Alert_Routing_for_Utilities) — similar · Opportunities
- [Data Center BMS Alarm Tuning](/Opportunities/Data_Center_BMS_Alarm_Tuning) — similar · Opportunities
- [Effluent Treatment Forecasting](/Opportunities/Effluent_Treatment_Forecasting) — similar · Opportunities
- [Generative Shift Handovers for Refineries](/Opportunities/Generative_Shift_Handovers_for_Refineries) — similar · Opportunities
- [Legacy Telemetry Parser](/Opportunities/Legacy_Telemetry_Parser) — similar · Opportunities
- [Maintenance Diagnostics](/CompanyTypes/Industrial_Facility_Operator/Opportunities/Maintenance_Diagnostics) — similar · Opportunities
- [AI Alert Aggregation](/Opportunities/AI_Alert_Aggregation) — similar · Opportunities
- [Machine Telemetry Engine](/Opportunities/Machine_Telemetry_Engine) — similar · Opportunities
- [ICU Autonomous Alarm Tuning](/Opportunities/ICU_Autonomous_Alarm_Tuning) — similar · Opportunities
- [Pump Energy Optimization](/Opportunities/Pump_Energy_Optimization) — similar · Opportunities
- [Wastewater Reporting Automation](/Opportunities/Wastewater_Reporting_Automation) — similar · Opportunities
- [FloorSight AI](/Opportunities/FloorSight_AI) — similar · Opportunities
- [Cracking Unit Diagnostics](/Opportunities/Cracking_Unit_Diagnostics) — similar · Opportunities
- [Thermal Energy Telemetry for Mills](/Opportunities/Thermal_Energy_Telemetry_for_Mills) — similar · Opportunities
- [Pump Diagnostics Monitor](/Opportunities/Pump_Diagnostics_Monitor) — similar · Opportunities