The Surge That Wasn't There
A cybersecurity vendor scores accounts with an intent model that aggregates third-party content-consumption signals. On Monday the model flags a 340% week-over-week spike in 'intent' for a mid-market account, and the SDR team is told to prioritize it. Digging in, an analyst finds the spike comes from 41 page views of a single research report, all from the same IP range, all within a 3-hour window on Sunday night, and all on a topic the account's industry reads heavily during an annual compliance deadline. The account has not opened any vendor email in 90 days, has no open opportunity, and its known contacts are two IT administrators. The model weights unique visitors, recency, and topic relevance, but does not deduplicate by IP or distinguish anonymous from known visitors.
1. Assess the signal quality and explain why raw intent score is misleading here.
Read the worked answer
The signal is high-volume but low-quality. Key problems:
- Concentration, not breadth. 41 views of one report from one IP range is a single anonymous actor, not 41 interested buyers. The model weights unique visitors, but if it counts sessions or views rather than deduplicated identities, it inflates.
- Timing and context. A Sunday-night burst aligned with an industry compliance deadline is consistent with routine research or even automated/aggregator traffic, not buying intent.
- No corroboration. No email engagement in 90 days, no open opportunity, and only two known IT admins means the account lacks the buying committee an 'executive' intent signal would imply.
- Anonymous vs. known. The model doesn't separate anonymous research from identified contacts, so a spike in anonymous traffic can masquerade as account-level intent.
The 340% figure is a measurement artifact, not evidence of purchase readiness.
2. Recommend how to adjust scoring and how the SDR team should treat this account this week.
Read the worked answer
Model changes:
- Deduplicate by IP/device and by known contact before scoring; cap the contribution of any single source or topic.
- Weight identified contacts higher than anonymous traffic, and require corroboration (e.g., email engagement or a known buying-committee member) before a spike raises priority materially.
- Add a concentration penalty so a burst from one IP range cannot dominate the score.
- Normalize for seasonality - compliance-deadline topic surges should be modeled as baseline, not intent.
This week:
- Do not treat the account as top priority on intent alone. Route it to a low-touch track or a monitoring list.
- Verify by checking whether any known contact engaged; if not, the signal is anonymous research.
- If a known contact later appears or the account opens email, re-score with corroboration and then engage.
Document the false positive so the model team can calibrate; a 340% spike that produces no action is a useful training example.