Most operators are convinced they already do production surveillance. They have SCADA, they have a control room screen, they have a daily flash report. None of that is production surveillance. It is production monitoring with the word "surveillance" attached, and the gap between the two is where the cash flow goes. Surveillance only counts when an anomaly becomes a ranked, dollar-denominated, time-bound action in a crew's truck cab. Anything that stops at the dashboard is theater.
The word problem
Production surveillance is a phrase the industry has been using since the late 1980s. It came out of the major-IOC field-of-the-future programs that put control rooms behind every offshore complex and onshore mega-asset. In that context the term meant something specific: a small team of engineers and operations specialists, sitting in a centralized room, watching live signal from a producing asset, intervening when the signal said to intervene.
The word migrated. By the mid-2000s a SCADA vendor selling polling intervals and trend charts was calling itself a production surveillance product. By the mid-2010s a dashboard built on top of a historian was calling itself the same. By 2026 the term has been stretched to cover any software that displays a production number on a screen. The action half of the original definition (intervene when the signal says to intervene) quietly fell off, and the watching half got rebranded as "real-time visibility."
The result is that most independent operators today describe themselves as running production surveillance and run nothing of the kind. They run production monitoring. The two words look similar. They do completely different things to free cash flow.
What production monitoring actually delivers
Production monitoring is the act of putting a live or near-live production number in front of a human. It is a precondition for surveillance. It is not surveillance.
The visible artifacts of monitoring are familiar. A SCADA HMI in a control room with a wall of trends. A morning production flash report assembled overnight from the historian and the lease accounting system. An exception dashboard that lights up red when a measurement crosses a threshold. A vendor field-of-view portal that lets the operator zoom into a specific well and see the last 24 hours of flow.
Each of those artifacts puts numbers in front of eyes. None of them, on its own, does the next thing.
What monitoring does not do, by design:
- It does not rank the anomaly against the rest of the field by dollar impact, so every alarm reads as equally urgent and the loudest one wins attention.
- It does not score the anomaly against the operator's economic context (working interest, lifting cost, commodity strip, deferment risk), so the operator cannot tell whether the alarm is worth a truck roll today or a callback next week.
- It does not assign a crew, sequence the route, account for skill match, equipment dependency, or hours of service.
- It does not capture an outcome when the work is done, so the model that generated the alarm never learns whether the call was right.
- It does not close the loop. The same alarm fires the same way next quarter, regardless of whether anyone acted on it.
The operator who buys a monitoring stack and calls it surveillance gets the first half of the value chain and leaves the second half on the table. That is where the 15 percent cash flow gap shows up, and it is structural, not a discipline problem.
Get the WorkSync Field Ops Brief
Monthly read for upstream + midstream operations leaders. Case studies, benchmarks, and what's changing in the field. Unsubscribe anytime.
What production surveillance is supposed to do, end to end
The complete definition of production surveillance, the one the original IOC programs deployed, runs end to end. Five elements, each of which has to actually happen.
Detect. Live or near-live signal from SCADA, well tests, run tickets, deferment data, inspections, and route history is read continuously. ML models calibrated to each well's normal behavior catch deviations the static-threshold alarm could not. The detection layer is what most operators have. It is necessary and far from sufficient.
Score. Every detected anomaly is scored by estimated dollar impact, not by alarm severity. The scoring carries the well's current production rate, the strip on the relevant streams, the working interest, the lifting cost, and the deferment risk if the anomaly is left to run. A stuck valve on a 5 BOPD stripper at $60 oil scores below a failing rod pump on a 200 BOPD producer at $80 oil. The ranking comes out in dollars, not red bars.
Route. The scored anomaly is added to the day's work, evaluated against the crew roster, sequenced by geography, qualified by skill match and equipment dependency, bounded by hours of service, and assigned. A constraint-aware optimizer turns the ranked list into an executable plan, not a suggestion.
Execute. The assignment lands in the truck cab on a mobile tool the field worker actually uses. The form fills itself. The pumper confirms what is true. The work gets done with a captured outcome (production restored, equipment status, time on site) attached to the originating anomaly.
Learn. The outcome feeds back into the detection model and the scoring model overnight. The next morning's plan reflects what was learned the day before. False alarms go down. Confidence on real anomalies goes up. Ranking accuracy compounds.
If any one of those five elements is missing, the result is not production surveillance. It is one of the four partial states most operators are in today: monitoring without ranking, ranking without routing, routing without execution feedback, or execution without learning. Each partial state leaves a measurable fraction of the cash flow in the field.
Where most operators actually sit
The honest assessment we run with most independents during the 24-hour AI operations diagnostic puts them somewhere on the same five-stop maturity ladder. The pattern is consistent enough to be useful.
A handful of operators run the first stop only. SCADA is alarming on threshold breaches. There is no central screen and no consolidated daily plan. Field operations runs fixed routes regardless of what changed overnight. This is the era-1 baseline.
Most independents run the first two stops. SCADA is alarming, a historian-based dashboard is in place, a morning flash report goes out at 7 AM, and a foreman looks at the dashboard before the route gets cut. The route still gets cut against habit and proximity because the dashboard does not rank by dollars and the operator does not have the time to do the math by hand each morning.
A smaller group runs three stops. Detection and scoring are both in place. The ranked list lives in a dashboard somewhere or in a daily report. Execution still happens off the ranked list because routing, crew sequencing, and mobile delivery are not connected to it. The pumper's day is still set by the foreman texting around at 5:30 AM.
A very small group runs four. The ranked list is sequenced into a daily plan, the plan lands in the truck cab, the work gets done. The outcome is not captured back into the model, so the system does not learn. The same alarm fires the same way next quarter, regardless of whether the response was correct.
The supermajors and the top quartile of Lower-48 independents run all five. ExxonMobil and SLB's gas-lift optimization on 1,300-plus unconventional wells, ConocoPhillips's Plunger Lift Optimization Tool on 4,500-plus wells, and the internal AI programs the supermajors now name on their earnings calls all run the full loop. The operating delta between the top quartile and everyone else, measured at the free-cash-flow line, is the 15 to 18 percent gap that is now showing up at every RBL redetermination cycle.
Why the dashboard is the trap
The dashboard is not a bad tool. It is a bad endpoint.
A dashboard is rational behavior at the era-1 to era-2 stops on the maturity ladder. It is the proof that the historian is working and the data is flowing and the operations team can see what is happening. It is the artifact a CIO can hand to a CEO to show that "we are running modern operations." The dashboard is also, often, what the SCADA vendor and the data-platform vendor pitched as the deliverable, because building the dashboard is the part of the value chain those vendors actually do.
The trap is mistaking the dashboard for the destination. A ranked list is not a plan. A plan is not a dispatch. A dispatch is not an outcome. An outcome is not learning. Every one of those handoffs is where the value compounds, and every one of them is missing from the dashboard-led approach. Operators who have spent two or three quarters trying to get the field team to act off the dashboard usually conclude that the field team will not change behavior. The honest read is that the dashboard cannot tell them what to do in the language they need it in.
Why WellOPS Production Surveillance is the answer the operator can buy this quarter
WellOPS does production surveillance end to end. Detection on top of the SCADA, well-test, run-ticket, and deferment data the operator already runs. Scoring on the operator's actual economics, not on alarm severity. Routing against the crew roster, the skill matrix, the equipment dependencies, and the geography. Execution in the truck cab through the Willie voice agent and the Field Data Capture mobile surface so the pumper does not have to type a form at the end of a long shift. Learning that runs nightly so the next morning's plan reflects what the field did yesterday.
The deployment shape is the same shape the four-week pump-by-priority pilot takes. Week one to integrate read-only over the existing stack through the DataHUB. Two weeks to put the ranked plan in the cab. One week to measure against a metric the controller signs for on day zero. The Impact Guarantee carries the financial risk: if the metric does not move past the threshold, the operator walks away with the integration documentation and the baseline dataset, no license fee, no kill fee. The architecture is the same whether the surveillance is sitting on top of a 200-well operation or the 5,000-plus-well three-basin deployment the WellOPS team has shipped against. The closed loop scales because it was designed as a closed loop, not as a dashboard that grew downstream attachments.
The diagnostic questions worth a week
If you are not sure where your own operation sits on the five-stop ladder, run these three diagnostics against your own field this week.
When an anomaly is detected at 2 AM, what is the path from the anomaly to a crew arriving on site? Map every handoff. Count how many of them are a human reading a screen and deciding. The number is how many points on the path your current "surveillance" actually stops at.
When the crew gets there and finishes the work, is the outcome attached to the originating anomaly in any system? Can you query, six months from now, the percentage of alarms on a given well type that produced a real intervention versus a no-finding visit? If you cannot, you are not running the learning step, which means your detection accuracy is whatever it was on day one of the install and is not improving.
When you look at this morning's work plan, can you tell, in dollars, what the top three tasks are worth? If you can tell in alarm severity but not in dollars, you are doing pump-by-exception. If you can tell in dollars but not in sequenced crew assignments, you are stopping at the score. Production surveillance is the full chain. Anything short of it is leaving cash flow in the field.
The bottom line
Production surveillance is end to end or it is theater. The operators winning at the RBL redetermination and at the PE term sheet today are the ones running the full five-element loop on top of the systems they already own. The ones who are still pointing at the dashboard are not behind on technology. They are behind on definition. WellOPS Production Surveillance is the version of that loop the operator can buy this quarter, sized for a four-week pilot, priced below VP signing authority, and underwritten by an Impact Guarantee that puts the financial risk on us.
The dashboard is not the destination. The destination is a ranked, dollar-denominated, time-bound, sequenced day in every truck cab by 6 AM. Run that, and the surveillance is real.
