IOA Detection Calculator
Estimate the chance of catching an attack chain from behavioural detections, using per-step probability across the chain.
Inputs
For example: initial access, execution, persistence, credential access, exfiltration.
Chance of Detecting the Chain
98.15%
Chance the Chain Goes Undetected
1.85%
Behaviour Coverage
71.1%
Measured Detection Rate From Emulation
68.3%
Steps Needed for 95% Confidence
3.8steps
False Positives per Detected Chain
18.3alerts
Behavioural Detection Verdict
Strong — multiple independent chances to catch the chain
Step by step
Values used
Steps in the attack chain you instrument = 5 steps; Detection probability per instrumented step = 55 %; Behaviours monitored = 45 behaviours; Behaviours with a working detection = 32 behaviours; Emulation tests run = 60 tests; Emulation tests detected = 41 tests; Behavioural false positives per day = 18 alerts/day
IOA Detection
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps.
Steps to 95% confidence
Steps needed for 95% confidence = ln(0.05) ÷ ln(1 − p), which is why breadth beats per-rule perfection.
Chance of Detecting the Chain
= 98.15
Chance the Chain Goes Undetected
= 1.85
Behaviour Coverage
= 71.1
Measured Detection Rate From Emulation
= 68.3
Steps Needed for 95% Confidence
= 3.8 steps
False Positives per Detected Chain
= 18.3 alerts
How it works
Behavioural detection is a series of independent chances rather than a single gate: five steps at 55% each leave only a 1.8% chance that all five are missed. This is the mathematical case for instrumenting more of the chain instead of trying to make one detection perfect. IOAs survive what IOCs cannot — attackers rotate infrastructure and recompile tooling daily, but the behaviour of dumping credentials or establishing persistence changes far more slowly, so chain-level probability is the honest measure of resilient detection.
Formulas
IOA Detection
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps.
- per-step probability
- Chance one instrumented step raises a detection
- instrumented steps
- Chain stages where you actually collect and analyse telemetry
- (1 − p)^n
- Probability every step is missed
Steps to 95% confidence
Steps needed for 95% confidence = ln(0.05) ÷ ln(1 − p), which is why breadth beats per-rule perfection.
- 0.05
- Residual 5% chance of missing the whole chain
- p
- Per-step detection probability
Frequently Asked Questions
How is IOA Detection calculated?
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps. Behavioural detection is a series of independent chances rather than a single gate: five steps at 55% each leave only a 1.8% chance that all five are missed. This is the mathematical case for instrumenting more of the chain instead of trying to make one detection perfect.
Why does IOA Detection matter?
IOAs survive what IOCs cannot — attackers rotate infrastructure and recompile tooling daily, but the behaviour of dumping credentials or establishing persistence changes far more slowly, so chain-level probability is the honest measure of resilient detection.
What values do I need to enter?
This calculator takes 7 inputs: Steps in the attack chain you instrument, Detection probability per instrumented step, Behaviours monitored, Behaviours with a working detection, Emulation tests run, Emulation tests detected, Behavioural false positives per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Are the steps really independent?
Not perfectly. A single blind spot — say, no EDR on the server estate — correlates failures across several steps at once, so treat this figure as an optimistic ceiling and check that your instrumented steps depend on different telemetry sources.
How does this compare with IOC matching?
IOC matching is a single high-precision, low-recall check that fails the moment infrastructure rotates. Behavioural detection trades precision for recall and gets multiple attempts per intrusion, which is why the two are complements rather than substitutes.