An anomaly detector flags every crisis

An unsupervised detector flags market stress as anomalous. How would you determine whether the alerts improve a risk decision?

Define the action and decision cost before evaluating alerts. Measure lead time, false alarms, missed events and the realised consequences of acting, using information available at each timestamp. A detector can describe a crisis only after losses occur, or suppress profitable recovery periods. Unsupervised separation is not automatically useful risk forecasting. Assess regime coverage and uncertainty because major stress episodes are few.