IOA Detection Calculator
Estimate the chance of catching an attack chain from behavioural detections, using per-step probability across the chain.
About IOA Detection Calculator
Behavioural detection is a series of independent chances rather than a single gate: five steps at 55% each leave only a 1.8% chance that all five are missed. This is the mathematical case for instrumenting more of the chain instead of trying to make one detection perfect. IOAs survive what IOCs cannot — attackers rotate infrastructure and recompile tooling daily, but the behaviour of dumping credentials or establishing persistence changes far more slowly, so chain-level probability is the honest measure of resilient detection.
Formulas
IOA Detection
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps.
- per-step probability
- Chance one instrumented step raises a detection
- instrumented steps
- Chain stages where you actually collect and analyse telemetry
- (1 − p)^n
- Probability every step is missed
Steps to 95% confidence
Steps needed for 95% confidence = ln(0.05) ÷ ln(1 − p), which is why breadth beats per-rule perfection.
- 0.05
- Residual 5% chance of missing the whole chain
- p
- Per-step detection probability
Worked example
With the default values below, IOA Detection Calculator returns Chance of Detecting the Chain of 98.15%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Steps in the attack chain you instrumentaccepts 1–30 steps
- 5 steps
- Detection probability per instrumented stepaccepts 0–100 %
- 55 %
- Behaviours monitoredaccepts 1–5,000 behaviours
- 45 behaviours
- Behaviours with a working detectionaccepts 0–5,000 behaviours
- 32 behaviours
- Emulation tests runaccepts 0–10,000 tests
- 60 tests
- Emulation tests detectedaccepts 0–10,000 tests
- 41 tests
- Behavioural false positives per dayaccepts 0–100,000 alerts/day
- 18 alerts/day
Results
- Chance of Detecting the Chain
- 98.15%
- Chance the Chain Goes Undetected
- 1.85%
- Behaviour Coverage
- 71.1%
- Measured Detection Rate From Emulation
- 68.3%
- Steps Needed for 95% Confidence
- 3.8 steps
- False Positives per Detected Chain
- 18.3 alerts
- Behavioural Detection Verdict
- Strong — multiple independent chances to catch the chain
Step by step
- 1Values used
- 2IOA Detection
- 3Steps to 95% confidence
- 4Chance of Detecting the Chain= 98.15
- 5Chance the Chain Goes Undetected= 1.85
- 6Behaviour Coverage= 71.1
- 7Measured Detection Rate From Emulation= 68.3
- 8Steps Needed for 95% Confidence= 3.8 steps
- 9False Positives per Detected Chain= 18.3 alerts
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is IOA Detection calculated?
Chance of detecting the chain = 1 − (1 − per-step detection probability)^number of instrumented steps. Behavioural detection is a series of independent chances rather than a single gate: five steps at 55% each leave only a 1.8% chance that all five are missed. This is the mathematical case for instrumenting more of the chain instead of trying to make one detection perfect.
Why does IOA Detection matter?
IOAs survive what IOCs cannot — attackers rotate infrastructure and recompile tooling daily, but the behaviour of dumping credentials or establishing persistence changes far more slowly, so chain-level probability is the honest measure of resilient detection.
What values do I need to enter?
This calculator takes 7 inputs: Steps in the attack chain you instrument, Detection probability per instrumented step, Behaviours monitored, Behaviours with a working detection, Emulation tests run, Emulation tests detected, Behavioural false positives per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Are the steps really independent?
Not perfectly. A single blind spot — say, no EDR on the server estate — correlates failures across several steps at once, so treat this figure as an optimistic ceiling and check that your instrumented steps depend on different telemetry sources.
How does this compare with IOC matching?
IOC matching is a single high-precision, low-recall check that fails the moment infrastructure rotates. Behavioural detection trades precision for recall and gets multiple attempts per intrusion, which is why the two are complements rather than substitutes.