Alert False Positive Rate Calculator
Compute false-positive rate, false discovery rate and precision from triage outcomes, then price the wasted analyst time.
About Alert False Positive Rate Calculator
The two rates answer different questions and are routinely confused. False positive rate divides by the enormous population of benign events, so it looks tiny — 0.1% of ten million events is still ten thousand alerts. False discovery rate divides by the alerts actually raised, which is the ratio analysts experience in the queue. Every percentage point of false discovery rate is analyst hours that buy nothing, and sustained rates above 75% are the strongest predictor of both missed incidents and SOC attrition.
Formulas
Alert False Positive Rate
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN).
- TP
- Alerts confirmed malicious
- FP
- Alerts closed as benign
- TN
- Benign activity correctly left unalerted
- FN
- Malicious activity that raised no alert
Cost of noise
Wasted hours = FP × minutes per false positive ÷ 60; annualised cost = wasted hours × hourly cost × 365 ÷ period days.
- minutes per false positive
- Mean triage time before closure
- hourly cost
- Fully loaded analyst cost — a user-supplied assumption
Worked example
With the default values below, Alert False Positive Rate Calculator returns False Discovery Rate of 86.67%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- True positives (confirmed malicious)accepts 0–1,000,000 alerts
- 40 alerts
- False positives (closed benign)accepts 0–1,000,000 alerts
- 260 alerts
- True negatives (benign events correctly not alerted)accepts 0–1,000,000,000 events
- 240,000 events
- False negatives (missed, found later)accepts 0–100,000 incidents
- 6 incidents
- Minutes spent per false positiveaccepts 0.5–480 minutes
- 12 minutes
- Fully loaded analyst cost per houraccepts 0–1,000 $/hour
- 65 $/hour
- Measurement periodaccepts 1–3,650 days
- 30 days
Results
- False Discovery RateShare of raised alerts that were wrong — the number analysts feel.
- 86.67%
- False Positive RateFP ÷ (FP + TN) — the classifier's specificity complement.
- 0.1082%
- Precision
- 13.33%
- Recall
- 86.96%
- Specificity
- 99.8918%
- Analyst Hours Lost to False Positives
- 52.0 hours
- Annualised Cost of False Positives
- $41,123
- Tuning Verdict
- Poor — typical of untuned content, and the main driver of fatigue
Step by step
- 1Values used
- 2Alert False Positive Rate
- 3Cost of noise
- 4False Discovery Rate= 86.67
- 5False Positive Rate= 0.1082
- 6Precision= 13.33
- 7Recall= 86.96
- 8Specificity= 99.8918
- 9Analyst Hours Lost to False Positives= 52.0 hours
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or tax into account.
- Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Alert False Positive Rate calculated?
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). The two rates answer different questions and are routinely confused. False positive rate divides by the enormous population of benign events, so it looks tiny — 0.1% of ten million events is still ten thousand alerts. False discovery rate divides by the alerts actually raised, which is the ratio analysts experience in the queue.
Why does Alert False Positive Rate matter?
Every percentage point of false discovery rate is analyst hours that buy nothing, and sustained rates above 75% are the strongest predictor of both missed incidents and SOC attrition.
What values do I need to enter?
This calculator takes 7 inputs: True positives (confirmed malicious), False positives (closed benign), True negatives (benign events correctly not alerted), False negatives (missed, found later), Minutes spent per false positive, Fully loaded analyst cost per hour, Measurement period. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Which number should I report to management?
False discovery rate. It is intuitive ('72% of what we investigate is nothing'), it maps directly to cost, and it moves when tuning works. Keep false positive rate for detection engineering, where the benign population matters.
Why is my false positive rate so small when the queue is unbearable?
Because the denominator is every benign event, and there are millions of them. A rate of 0.01% against 50 million daily events is 5,000 alerts a day. Always sanity-check the rate against the absolute count.