Alert False Positive Rate Calculator
Compute false-positive rate, false discovery rate and precision from triage outcomes, then price the wasted analyst time.
Inputs
A user-supplied assumption — salary, benefits, tooling and overhead.
False Discovery Rate
86.67%
Share of raised alerts that were wrong — the number analysts feel.
False Positive Rate
0.1082%
FP ÷ (FP + TN) — the classifier's specificity complement.
Precision
13.33%
Recall
86.96%
Specificity
99.8918%
Analyst Hours Lost to False Positives
52.0hours
Annualised Cost of False Positives
$41,123
Tuning Verdict
Poor — typical of untuned content, and the main driver of fatigue
Step by step
Values used
True positives (confirmed malicious) = 40 alerts; False positives (closed benign) = 260 alerts; True negatives (benign events correctly not alerted) = 240,000 events; False negatives (missed, found later) = 6 incidents; Minutes spent per false positive = 12 minutes; Fully loaded analyst cost per hour = 65 $/hour; Measurement period = 30 days
Alert False Positive Rate
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN).
Cost of noise
Wasted hours = FP × minutes per false positive ÷ 60; annualised cost = wasted hours × hourly cost × 365 ÷ period days.
False Discovery Rate
= 86.67
False Positive Rate
= 0.1082
Precision
= 13.33
Recall
= 86.96
Specificity
= 99.8918
Analyst Hours Lost to False Positives
= 52.0 hours
How it works
The two rates answer different questions and are routinely confused. False positive rate divides by the enormous population of benign events, so it looks tiny — 0.1% of ten million events is still ten thousand alerts. False discovery rate divides by the alerts actually raised, which is the ratio analysts experience in the queue. Every percentage point of false discovery rate is analyst hours that buy nothing, and sustained rates above 75% are the strongest predictor of both missed incidents and SOC attrition.
Formulas
Alert False Positive Rate
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN).
- TP
- Alerts confirmed malicious
- FP
- Alerts closed as benign
- TN
- Benign activity correctly left unalerted
- FN
- Malicious activity that raised no alert
Cost of noise
Wasted hours = FP × minutes per false positive ÷ 60; annualised cost = wasted hours × hourly cost × 365 ÷ period days.
- minutes per false positive
- Mean triage time before closure
- hourly cost
- Fully loaded analyst cost — a user-supplied assumption
Frequently Asked Questions
How is Alert False Positive Rate calculated?
False discovery rate = FP ÷ (FP + TP). False positive rate = FP ÷ (FP + TN). Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). The two rates answer different questions and are routinely confused. False positive rate divides by the enormous population of benign events, so it looks tiny — 0.1% of ten million events is still ten thousand alerts. False discovery rate divides by the alerts actually raised, which is the ratio analysts experience in the queue.
Why does Alert False Positive Rate matter?
Every percentage point of false discovery rate is analyst hours that buy nothing, and sustained rates above 75% are the strongest predictor of both missed incidents and SOC attrition.
What values do I need to enter?
This calculator takes 7 inputs: True positives (confirmed malicious), False positives (closed benign), True negatives (benign events correctly not alerted), False negatives (missed, found later), Minutes spent per false positive, Fully loaded analyst cost per hour, Measurement period. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Which number should I report to management?
False discovery rate. It is intuitive ('72% of what we investigate is nothing'), it maps directly to cost, and it moves when tuning works. Keep false positive rate for detection engineering, where the benign population matters.
Why is my false positive rate so small when the queue is unbearable?
Because the denominator is every benign event, and there are millions of them. A rate of 0.01% against 50 million daily events is 5,000 alerts a day. Always sanity-check the rate against the absolute count.