← All posts

WhatsApp alerts vs email — when to use which

If you ship security alerts to people, you have learned a hard truth: most of them are ignored.

Email is sorted into a dozen folders no one checks. SMS gets blocked by carriers as suspected spam. Slack alerts pile up in #security-alerts and only one person watches it. WhatsApp, on the other hand, lands on the lock screen of a phone someone is already holding.

For SMEs without a 24/7 SOC, WhatsApp is the channel of last resort that actually works.

The honest comparison

| Channel | Reach | Latency | Friction | Best use | |--------|------|--------|---------|----------| | Email | 100% | minutes–hours | low | Daily digest, weekly progress, low-urgency findings | | Slack | Coverage gaps outside hours | seconds–minutes | medium | Team-visible business hours alerts | | SMS | Often blocked, low CTR | seconds | low | Backup channel for critical | | WhatsApp | Very high read-rate, business-aware | seconds | medium | Critical, owner-must-see | | Teams | Same as Slack | seconds–minutes | medium | Microsoft-shop alternative to Slack |

A reasonable alerting policy

For an SME of 10–200 people, this policy works in practice:

  • Critical (live credential leak, account takeover, brand impersonation, payment-flow Magecart): WhatsApp + Email + Slack DM. Page on-call after 15 minutes if unacknowledged.
  • High (SSL expiring < 7 days, new privileged user added externally, GHAS alert): Slack channel + Email. WhatsApp opt-in.
  • Medium (new Dependabot finding, weak DMARC policy, cookie-consent gap): Slack channel + weekly email digest.
  • Low (informational, hardening recommendations): Weekly email digest only.

This produces zero alert fatigue and zero missed criticals.

Why WhatsApp Business specifically

Personal WhatsApp prohibits commercial use. WhatsApp Business is the supported path:

  • Templates require Meta approval (1–3 weeks lead time).
  • Per-message cost: typically $0.005–$0.05 depending on country.
  • 24-hour reply window — once the recipient responds, you can send free-form for 24h.
  • Read receipts surface in your dashboard so you know it landed.

How to set up — the practical guide

  1. Apply for WhatsApp Business API access (Meta Business Suite). Use a phone number you control and that you do not use for personal WhatsApp.
  2. Submit 3–4 templates for approval — typically critical alert, weekly digest, expiry reminder, welcome. Keep them short, plain, no marketing fluff. Meta rejects pushy content.
  3. Pick a Business Solution Provider (BSP). Direct Meta integration is technical; using Kapso, Twilio, or 360dialog cuts the setup from weeks to hours.
  4. Wire it into your monitoring tool as a webhook destination. Most security tools (NoDowntimeShield included) ship a built-in WhatsApp connector.

Common mistakes

  • Sending too often. WhatsApp recipients can mark you as spam in two taps. One critical alert per week is the upper bound for most users.
  • Using WhatsApp for marketing. Meta will suspend you. Stick to operational alerts only.
  • No opt-in. Get explicit consent before adding a number. The owner clicks "yes, send me critical alerts."
  • Sending from a personal number. Use Business API only.

What we recommend

Start with Email + Slack. Add WhatsApp once you have your alerting policy clear. Treat it as the channel of last resort — used sparingly, it stays effective for years.

NoDowntimeShield includes WhatsApp alerts on the Pro plan and above. Start at /check.