Estimate the chance of catching an attack chain from behavioural detections, using per-step probability across the chain.
Behavioural detection is a series of independent chances rather than a single gate: five steps at 55% each leave only a 1.8% chance that all five are missed. This is the mathematical case for instrumenting more of the chain instead of trying to make one detection perfect. IOAs survive what IOCs cannot — attackers rotate infrastructure and recompile tooling daily, but the behaviour of dumping credentials or establishing persistence changes far more slowly, so chain-level probability is the honest measure of resilient detection.
IOA Detection
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps.
Steps to 95% confidence
Steps needed for 95% confidence = ln(0.05) ÷ ln(1 − p), which is why breadth beats per-rule perfection.
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps. Behavioural detection is a series of independent chances rather than a single gate: five steps at 55% each leave only a 1.8% chance that all five are missed. This is the mathematical case for instrumenting more of the chain instead of trying to make one detection perfect.
IOAs survive what IOCs cannot — attackers rotate infrastructure and recompile tooling daily, but the behaviour of dumping credentials or establishing persistence changes far more slowly, so chain-level probability is the honest measure of resilient detection.
This calculator takes 7 inputs: Steps in the attack chain you instrument, Detection probability per instrumented step, Behaviours monitored, Behaviours with a working detection, Emulation tests run, Emulation tests detected, Behavioural false positives per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Not perfectly. A single blind spot — say, no EDR on the server estate — correlates failures across several steps at once, so treat this figure as an optimistic ceiling and check that your instrumented steps depend on different telemetry sources.
IOC matching is a single high-precision, low-recall check that fails the moment infrastructure rotates. Behavioural detection trades precision for recall and gets multiple attempts per intrusion, which is why the two are complements rather than substitutes.