Most adverse situations are preceded by a period during which someone is looking. Researchers query records, journalists request documents, third parties make inquiries against the principal's name. Each of these leaves a trace. The traces are not, in themselves, conclusive. Read together, the pattern they form often is.

Looking, taken as a quantity, has a normal distribution against any given name. Some level of inquiry is routine: due diligence requests, the activity of automated profilers, the steady background of commercial monitoring. The desk's systems baseline this routine and watch for departures from it. A sudden cluster of fresh inquiries from a particular jurisdiction. An inquiry pattern that matches the early stages of investigative journalism. A query profile consistent with pre-action research before a legal claim.

When the pattern departs from the baseline, the desk knows. The departure itself does not necessarily mean a problem is coming. It means a problem may be coming, and that the range of available responses is still wide. By the time the same pattern becomes visible through ordinary means (the published article, the filed claim, the public registration), the range of responses has narrowed.

This is what early detection means in practice. Not predicting the future. Reading, in advance, the activity that precedes the future others can already see.