The balance is between having too low a trigger threshold (which causes too much time to be spent following up false positives) versus too high (which causes missed or delayed detection of true events).