The Downdetector integration looks weird on first read. It's a consumer-facing service-outage reporter. People go there to find out whether Spotify is down. What does that have to do with whether your stadium is safe on a Saturday?
The answer is that the people reporting outages aren't reporting outages. They're reporting that their phones aren't working, and the most common reason your phone stops working at a stadium isn't a Spotify outage — it's that ten thousand other people are also at the stadium and the local cell tower is saturated.
Which means Downdetector, almost by accident, is a real-time crowd-density signal. And crowd density is one of the leading indicators of crowd risk that operators have systematically underinvested in.
What Downdetector actually measures
Downdetector aggregates user-submitted reports of service problems, tagged by carrier and ZIP code. The Cisco-owned Downdetector Enterprise API ($500–$2,000/mo BYOK on partner contract) exposes those aggregations programmatically: outage report counts per carrier per geographic unit, in near-real-time.
For a Verizon outage in Brooklyn, you see a spike in Verizon reports from Brooklyn ZIPs. Useful if you're Verizon. For event security, the interesting cases aren't actual carrier outages — they're the false positives. Reports spike because users perceive their service as degraded. The most common cause of perceived degradation, at scale, in a concentrated geography, is crowd saturation of local capacity.
The 30-60 minute lead
Cell capacity in most urban event catchments — stadiums, festival sites, concert venues — is sized for normal residential and commercial usage. When 22,000 people show up to a 22,000-capacity venue, the local towers don't fail; they degrade. Speeds drop, calls get queued, data sessions drop and retry. Users perceive this as "my phone isn't working" and a small but consistent fraction of them report it.
The lead time between cell-saturation-onset and event peak attendance — measured across festivals, stadium events, and arena shows we've observed — is consistently 30–60 minutes. The cell network saturates as the line for entry builds. Peak attendance hits when the show starts. The Downdetector spike precedes the peak.
For operations, that 30–60 minutes is the most actionable lead in the movement pillar. It's the gap between "we have a sense things are getting busy" and "we're at capacity." Most other movement signals (traffic, parking saturation, transit volumes) are coincident with peak, not leading.
Three operational use cases
Use case one: gate flow vs egress prep. If the Downdetector signal is climbing through the 60-minute pre-show window faster than your previous event baselines, expect peak attendance higher than projected. Pre-position egress staff and start coordinating with local PD on the post-event traffic plan earlier than your usual playbook.
Use case two: medical event probability. Crowd density and medical event rate are correlated — heat illness, fainting, alcohol-related incidents, panic responses. A Downdetector spike that arrives faster than baseline correlates (in our data) with a measurable uplift in medical pages during the first 90 minutes of the show. Pre-position medics accordingly.
Use case three: communications planning. If your operations team is communicating via cellular (which most are, even with radio backup), Downdetector tells you when your own comms are about to degrade. Switch primary comms to radio before the saturation hits, not after the first dropped check-in.
How we use it in the brief
On a SignalGuard scan, Downdetector lives in the Movement pillar alongside traffic, airspace, scanner feeds, and cellular performance. The signal contributes to the composite score and shows up in the reasoning trace when it's material.
Concretely: in the /scan brief, you might see a Movement-pillar line that reads "Downdetector Verizon-NYC10001 +312% vs venue 14-day rolling baseline, sustained 18 minutes, pre-peak window." That's actionable. It tells you the magnitude (3x baseline), the persistence (18 minutes — not a transient blip), and the position in the event timeline (pre-peak).
The synthesis layer (Claude Haiku 4.5, more on the scoring logic here) is instructed to treat Downdetector spikes as Movement-pillar evidence with elevated weight when they coincide with a Ticketmaster context flag for the venue or nearby venues. A 3x spike during a quiet weekday means nothing. A 3x spike thirty minutes before a sold-out show is operational data.
Why we wired it as BYOK
Downdetector Enterprise is one of the providers where the BYOK model is most defensible. The contract is $500–$2,000/mo, the partner approval process is straightforward for venue operators, and the data is high-value for exactly the audience we serve.
If we'd wired Downdetector on our own contract and resold it, we'd be marking up a $500/mo signal into a per-customer license fee. Instead, the venue holds the contract, we run the fusion logic, and the customer's marginal cost is the underlying provider price.
The wiring takes about ten minutes once the contract is in place. The /integrations page walks through the OAuth handshake. After that the signal flows into every scan on the venue's saved-event monitoring list.
The deeper point
The Downdetector integration is a small example of a larger pattern. Most of the highest-value signals for live-event threat intelligence aren't sold as event-security products. Downdetector sells itself as a consumer outage reporter. Ticketmaster Discovery sells itself as an event-discovery API. Open-Meteo sells itself as a weather API. The fusion is where the value gets created — not the individual signal contracts.
The corollary is that you should be skeptical of any threat-intel vendor whose pillar list overlaps neatly with the list of vendors who sell explicit "event security" products. The interesting signals are the adjacent ones.
If you want to wire Downdetector into your venue monitoring, the integration lives on /integrations. If you don't have the partner contract yet, run a free scan first at /scan and see how the rest of the Movement pillar reads — that'll tell you whether the upgrade is worth it.