Chapter 36 — Human factors and cyber policy: performance and scale

Chapter 36 — Human factors and cyber policy: performance and scale

Lesson map

Lesson 36 published. Map, example, EX106.

flowchart TD
  N0["Learning outcomes"]
  N1["36.1 Growth in reports"]
  N2["36.2 Queue modelling"]
  N3["Lab — Waiting time for verdicts as report volume gro"]
  N4["36.3 Staffing and automation"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX106"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["36.1 Growth in reports"]
  N2["36.2 Queue modelling"]
  N3["Lab — Waiting time for verdicts as report volume gro"]
  N4["36.3 Staffing and automation"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX106"]

[Learning outcomes]
    |
    v
[36.1 Growth in reports]
    |
    v
[36.2 Queue modelling]
    |
    v
[Lab — Waiting time for verdicts as report volume gro]
    |
    v
[36.3 Staffing and automation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX106]

Learning outcomes

You will (1) estimate triage capacity as reporting grows; (2) model queue waiting times; (3) plan staffing and automation to keep feedback fast.

36.1 Growth in reports

As the reporting service succeeds, report volume grows. Greyford receives about forty reports a day after launch and expects more as staff confidence rises and the programme extends to contractors. Each report needs triage, and the promise of quick feedback depends on triage keeping pace. Aiko estimates that a triage analyst can handle about twelve reports an hour after clustering. She asks what happens to waiting times when daily volume rises, because slow feedback would undermine the effect shown in chapter 17.

36.2 Queue modelling

The lab simulates a day of reports arriving at random during working hours and served by one analyst at a fixed rate, and records the average wait before a verdict. At forty reports a day the average wait is about seven minutes. At eighty it doubles to fourteen, and at ninety-five, when the analyst is busy almost all the time, it reaches twenty-five minutes, rising faster with each extra report, as queueing theory predicts when utilisation approaches one. Aiko uses the result to show managers that capacity must grow before volume reaches the steep part of the curve, not after complaints begin.

Lab — Waiting time for verdicts as report volume grows

# Single analyst triage queue over an 8-hour day (synthetic, seed fixed).
import random
def day(n, rate=12, seed=1):
    r = random.Random(seed); arr = sorted(r.uniform(0, 480) for _ in range(n))
    free = 0.0; waits = []
    for a in arr:
        start = max(a, free); free = start + 60 / rate; waits.append(free - a)
    return sum(waits) / n
for n in (40, 80, 95):
    print(f"{n} reports/day: mean wait to verdict {sum(day(n, seed=s) for s in range(200)) / 200:.0f} min")

Run with python3 lab_queue.py. Verified output:

40 reports/day: mean wait to verdict 7 min
80 reports/day: mean wait to verdict 14 min
95 reports/day: mean wait to verdict 25 min

36.3 Staffing and automation

Aiko proposes three measures: automatic clustering so identical reports count as one item, automatic verdicts for messages already confirmed as malicious, and a second analyst at peak times. Automation handles repetitive work, while people handle new or uncertain cases. She sets a service level of a verdict within one working hour for ninety percent of reports and a monthly check of the measure. If the service level slips for two months, staffing is reviewed. This keeps the feedback loop fast as the programme scales.

Worked example

Aiko models verdict waiting times as reports grow and plans clustering, automatic verdicts and peak staffing to keep feedback within an hour.

Synthetic case. Volumes and rates are synthetic.

Errors and limits

Real arrivals cluster around campaigns. Automatic verdicts can be wrong.

Exercises

• EX106 — Analyst rate. What triage rate did Aiko assume per analyst? Rubric: 3 = about twelve reports an hour;; 2 = twelve;; 1 = forty;; 0 = none.
• EX107 — Lab queue. How long were average waits at 40, 80 and 95 reports a day? Rubric: 3 = 7, 14 and 25 minutes;; 2 = rise;; 1 = vague;; 0 = none.
• EX108 — Service level. What service level did Aiko set? Rubric: 3 = verdict within one working hour for 90%;; 2 = one hour;; 1 = vague;; 0 = none.

Synthesis

Fast feedback at scale needs capacity planned before utilisation approaches its limit.

Continue studying — chapter 36 of 50

← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →