Theme
Risk Monitor
The Risk Monitor provides supervisors with a real-time view of conversation risk across the contact center. It surfaces intelligence data from the OmniBots real-time analysis engine, helping you identify conversations that may need intervention before they escalate.
Navigate to the Risk Monitor tab in the sidebar to open this view. The tab requires the agents.monitor permission.
Header Badges
The header area displays two live-updating badges:
| Badge | Description |
|---|---|
| AT RISK (red) | Count of conversations currently classified as Critical or High risk. Only appears when the count is greater than zero. |
| ACTIVE (blue) | Total number of active conversations being tracked by the intelligence engine. |
Both badges include a pulsing dot to indicate live data.
Risk Distribution
A row of four stat cards at the top of the view shows the breakdown of conversations by risk level.
| Card | Color | Risk Score Range |
|---|---|---|
| Critical | Red (#dc2626) | 80 -- 100 |
| High Risk | Orange (#ea580c) | 60 -- 79 |
| Medium Risk | Amber (#d97706) | 40 -- 59 |
| Low Risk | Green (#16a34a) | 0 -- 39 |
Each card displays the count of conversations currently in that risk bracket. The distribution updates in real time as the intelligence engine re-evaluates active conversations.
Conversations by Risk Level
Below the distribution cards, a table lists every active conversation that has intelligence data, sorted by risk score from highest to lowest.
| Column | Description |
|---|---|
| Risk | Badge showing the risk level -- CRITICAL, HIGH, MEDIUM, or LOW |
| Customer | Customer name from the inbox, or a conversation ID prefix if no name is available |
| Score | Numeric risk score out of 100, color-coded by severity |
| Cognitive | Cognitive load level badge -- OVERLOADED, HIGH, MODERATE, or LOW |
| Top Factor | The primary reason for the current risk assessment. This is pulled from rescue tactics if available, otherwise shows "Monitoring" or "Normal" |
| Sentiment | Sentiment trend indicator with directional icon -- improving (green, up arrow), stable (gray, flat), or declining (red, down arrow) |
TIP
The sentiment trend is calculated from the sentiment trajectory array. A difference of more than 0.15 between the first and last data points triggers an "improving" or "declining" label. Smaller changes are shown as "stable."
How Risk Data Arrives
Risk data is pushed to the Agent Desktop via WebSocket from the intelligence engine. The Risk Monitor reads from the intelligence store, which is updated in real time as the orchestrator evaluates conversations. There is no polling delay -- changes appear immediately.
Critical Row Highlighting
Rows with a CRITICAL risk level receive a subtle background tint to draw attention. Combined with the descending sort order, this ensures the most urgent conversations are always visible at the top of the table.
Risk monitor dashboard showing AT RISK and ACTIVE header badges, risk distribution cards for Critical, High, Medium, and Low levels, and a conversations table sorted by risk score with risk badge, customer name, score, cognitive load, top factor, and sentiment columns
Security Alerts
A second table below the risk conversations lists active security alerts. These alerts are fetched from the security API and refresh every 15 seconds.
| Column | Description |
|---|---|
| Severity | Badge showing the alert severity -- critical, high, medium |
| Alert | Description of the security event (e.g., "Prompt injection detected", "PII exfiltration attempt") |
| Conversation | Customer or visitor identifier associated with the alert |
| Risk Score | Numeric score out of 100 assigned to the alert |
| Type | Category of the security event -- Injection, Data Leak, Social Eng., Velocity, etc. |
| Time | How long ago the alert was triggered (e.g., "2m ago", "14m ago") |
WARNING
Security alerts with severity critical indicate active threats such as prompt injection or data exfiltration. These require immediate investigation. Review the flagged conversation and consider using the Live Monitor's barge or takeover controls to intervene.
Alert Types
| Type | Description |
|---|---|
| Injection | The user attempted to override bot instructions through prompt injection techniques |
| Data Leak | The bot's response contained sensitive data that should not have been exposed |
| Social Eng. | Conversational patterns consistent with social engineering attempts |
| Velocity | Abnormally high message volume from a single session in a short time window |
Risk Levels Explained
The intelligence engine assigns risk based on multiple signals evaluated during the conversation.
| Level | Score Range | Meaning |
|---|---|---|
| CRITICAL | 80 -- 100 | Immediate intervention recommended. The conversation shows strong signals of failure, fraud, or customer churn risk. |
| HIGH | 60 -- 79 | Close monitoring required. One or more risk factors are elevated and the conversation may deteriorate. |
| MEDIUM | 40 -- 59 | Some risk indicators present but within manageable thresholds. Keep an eye on sentiment trends. |
| LOW | 0 -- 39 | Conversation is proceeding normally with no concerning signals. |
Related Pages
- Live Monitor -- Monitor agent activity and use supervisor controls
- Agent Wellness -- Track agent burnout and workload metrics
- Security & Fraud Detection -- Configure security rules and detection thresholds