Recalibrating Risk Tiers Surfaces 1,702 Dark Events; 66% Cluster in the Singapore Strait
A scoring threshold change exposed 1,702 dark events that the SAR verification pipeline had been silently ignoring. 1,127 of them sit in one waterway.
The Setup
Before today: zero dark events at high or critical tier. The downstream Sentinel-1 verification job, which gates on risk_tier IN ('high','critical') before requesting SAR imagery, had been running daily for weeks and returning {checked: 0} every single time. The detector was producing thousands of events; the scorer was producing tier labels; the gate was producing nothing.
After a recalibration of the underlying threshold function: 1,702 events at high tier, 19 at critical, against 18,688 at low. The new high-tier band averages 28.1 risk score with a 14.0-hour median gap duration. Same data, same thirty-day window — only the threshold changed.
What the old configuration was telling SAR was a falsehood. The pipeline interpreted "no high-tier events" as "no actionable risk." The truth was "the boundary line was drawn above every event we saw." Recalibration moved the line.
The Chain
The score itself is built from gap duration, vessel-class priors, geographic context, and identity attributes. Each component has a documented weight; the final number lives between 0 and 50. The threshold table is a separate object — a mapping from continuous score ranges to four discrete labels. Until today the mapping required a score above ~25 to register as high; in practice, no event reached that bar because the geographic-context bonus had been calibrated against a different base distribution.
When the geographic-context coefficient was rescaled, the high-tier band repopulated. Singapore Strait took 1,127 of the 1,702 high-tier results — about 66% of newly-visible high-tier risk in the world is in one piece of water. Houston Ship Channel took 124. Rotterdam took 49. Hong Kong's Pearl River Delta took 2. Persian Gulf took 1, with a 452-hour gap. Everything else in the world summed to 399 events.
The critical tier — 19 events, average risk 38.2 — is now the SAR pipeline's queue. These are the cases where Sentinel-1 imagery purchases get triggered. They were sitting dormant in the database, scored but unfindable to the verification job, until the threshold moved.
The Implication
Two things change now that the gate has events to act on. First, the daily SAR verification cron will start spending money — the Sentinel-1 imagery API charges per scene, and 1,702 high-tier events at the current cadence implies ~57/day worth of candidate scenes. Most are in the same 5×5 km Singapore patch, so dedup will cut it down, but the budget line is no longer hypothetical.
Second, sanctions-screening teams that subscribe to the high-tier feed have a new firehose. Anyone downstream consuming risk_tier IN ('high','critical') for OFAC pre-screening should expect to see actionable matches where they previously saw nothing. The signal didn't appear today; it was always there. The threshold was hiding it.
The Singapore concentration deserves its own note. 1,127 high-tier events in a 30-day window in the Strait of Malacca is consistent with two known patterns: routine STS activity in the eastern bunkering anchorage, and the slow-transit corridor that vessels use to avoid the southbound TSS during off-peak hours. The detector cannot distinguish between "this vessel went dark to do a ship-to-ship transfer" and "this vessel went dark because of receiver coverage in the eastern anchorage." That disambiguation is what SAR verification is for.
What to Watch
- SAR verification hit rate — within two weeks the pipeline will produce a confirmation ratio. A high false-positive rate (SAR imagery shows nothing where AIS gap suggested a vessel) means the geographic-context bonus is still over-weighting Singapore.
- Gap-duration shift in the high-tier band. The 14-hour median is much shorter than the 25-hour median for the low-tier band — short gaps are now scoring HIGHER risk than long gaps, which is counter to the assumption that "longer dark = more suspicious." The detector is implicitly telling us the operational dark-event signature is short, not long.
- Houston Ship Channel high-tier volume vs. Singapore over the next 30 days. Houston is the dominant US sanctions-screening surface; if Houston's count grows faster than Singapore's after this recalibration, the geographic distribution of US-relevant risk has shifted.
Limitations
The recalibration is a threshold change, not a model change. Underlying scores did not move; only the labels we apply to them did. False-positive risk has therefore not changed in any deep sense — it has only become visible. The Singapore Strait's 66% concentration is also a known artifact of the AIS receiver geography in the region; vessels passing the eastern anchorage often lose terrestrial coverage even when they are operating normally. The high-tier feed is a starting point for SAR verification, not an end point.
The SAR pipeline itself was previously gated on verify-dark-fleet-sar-daily cron, which was deactivated on 2026-04-12 after the edge function was deleted; rebuilding that worker is a prerequisite for this signal to translate into confirmed sightings. Until then, the high-tier feed sits in the database, queryable but unverified.
Data current as of 2026-04-28. Source: Axiom Overwatch dark_events table, 30-day window, post-AXO-192 threshold recalibration. Underlying AIS data is mandated under SOLAS. axiomoverwatch.io/blog