Compute false-positive rate, false discovery rate and precision from triage outcomes, then price the wasted analyst time.
The two rates answer different questions and are routinely confused. False positive rate divides by the enormous population of benign events, so it looks tiny — 0.1% of ten million events is still ten thousand alerts. False discovery rate divides by the alerts actually raised, which is the ratio analysts experience in the queue. Every percentage point of false discovery rate is analyst hours that buy nothing, and sustained rates above 75% are the strongest predictor of both missed incidents and SOC attrition.
Alert False Positive Rate
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN).
Cost of noise
Wasted hours = FP × minutes per false positive ÷ 60; annualised cost = wasted hours × hourly cost × 365 ÷ period days.
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). The two rates answer different questions and are routinely confused. False positive rate divides by the enormous population of benign events, so it looks tiny — 0.1% of ten million events is still ten thousand alerts. False discovery rate divides by the alerts actually raised, which is the ratio analysts experience in the queue.
Every percentage point of false discovery rate is analyst hours that buy nothing, and sustained rates above 75% are the strongest predictor of both missed incidents and SOC attrition.
This calculator takes 7 inputs: True positives (confirmed malicious), False positives (closed benign), True negatives (benign events correctly not alerted), False negatives (missed, found later), Minutes spent per false positive, Fully loaded analyst cost per hour, Measurement period. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
False discovery rate. It is intuitive ('72% of what we investigate is nothing'), it maps directly to cost, and it moves when tuning works. Keep false positive rate for detection engineering, where the benign population matters.
Because the denominator is every benign event, and there are millions of them. A rate of 0.01% against 50 million daily events is 5,000 alerts a day. Always sanity-check the rate against the absolute count.