Abstract: Methods, apparatus, and systems are described for monitoring packages in transit within a network to determine which packages are at risk of being delivered after a stated commit time. In general, package fingerprints that define events expected to occur for the package while in transit and define thresholds for those events are generated from historical data of events occurring in the logistics network for packages in transit. Those thresholds may be applied to packages in real time as the events for the packages are occurring while the packages are in transit to then determine a level of risk for any package that has an event that occurs after the threshold for the event. Attention can be given to those packages that are at a sufficient level of risk.