IOC Match Rate Calculator
Measure how much of your threat-intel indicator set ever fires, how precise the matches are, and how much feed decay costs.
About IOC Match Rate Calculator
Hit rates on large commodity feeds are typically far below 1%, which is expected rather than alarming: most indicators describe infrastructure you will never be targeted by. The number that decides whether to alert on a feed is precision — what share of matches were real — combined with cost per true positive. Indicator feeds are bought by volume and consumed by relevance, and a quarter-million-indicator subscription producing twenty-two real detections a period is a spend decision disguised as a security control.
Formulas
IOC Match Rate
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events.
- indicators matched
- Distinct indicators that fired at least once
- match events
- Total alerts produced by indicator matching
- true positives
- Matches that turned out to be real
Decay and cost
Effective indicators = set size × (1 − stale share); feed cost per true positive = annual feed cost ÷ confirmed matches.
- stale share
- Indicators past their useful life — high for IPs and domains
- feed cost
- A user-supplied assumption
Worked example
With the default values below, IOC Match Rate Calculator returns Indicator Hit Rate of 0.0720%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Indicators in the active setaccepts 1–100,000,000 indicators
- 250,000 indicators
- Distinct indicators that matchedaccepts 0–100,000,000 indicators
- 180 indicators
- Match events raised in the periodaccepts 0–100,000,000 matches
- 1,450 matches
- Matches confirmed maliciousaccepts 0–100,000,000 matches
- 22 matches
- Events evaluated against the setaccepts 1–1,000,000,000,000 events
- 400,000,000 events
- Indicators past their useful lifeaccepts 0–100 %
- 35 %
- Annual cost of the intel feedsaccepts 0–10,000,000 $/year
- 60,000 $/year
Results
- Indicator Hit RateShare of the indicator set that ever matched anything.
- 0.0720%
- Match Precision
- 1.52%
- Matches per Million Events
- 3.625 matches/M
- Indicators Still Useful
- 162,500 indicators
- Matches That Were Not Malicious
- 1,428 matches
- Feed Cost per True Positive
- $2,727
- Feed Value Verdict
- Poor value — most matches are noise; stop alerting on this feed directly
Step by step
- 1Values used
- 2IOC Match Rate
- 3Decay and cost
- 4Indicator Hit Rate= 0.0720
- 5Match Precision= 1.52
- 6Matches per Million Events= 3.625 matches/M
- 7Indicators Still Useful= 162,500 indicators
- 8Matches That Were Not Malicious= 1,428 matches
- 9Feed Cost per True Positive= 2,727
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or tax into account.
- Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is IOC Match Rate calculated?
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events. Hit rates on large commodity feeds are typically far below 1%, which is expected rather than alarming: most indicators describe infrastructure you will never be targeted by. The number that decides whether to alert on a feed is precision — what share of matches were real — combined with cost per true positive.
Why does IOC Match Rate matter?
Indicator feeds are bought by volume and consumed by relevance, and a quarter-million-indicator subscription producing twenty-two real detections a period is a spend decision disguised as a security control.
What values do I need to enter?
This calculator takes 7 inputs: Indicators in the active set, Distinct indicators that matched, Match events raised in the period, Matches confirmed malicious, Events evaluated against the set, Indicators past their useful life, Annual cost of the intel feeds. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should low-confidence indicators alert at all?
No. Use them as enrichment — tag the event, raise the risk score, make them searchable — and reserve alerting for high-confidence, recently observed indicators tied to a specific campaign. This alone removes most intel-driven noise.
Why does indicator decay matter so much?
Because commodity IPs and domains rotate in days. Matching against expired indicators produces stale hits on infrastructure now hosting something innocuous, which is precision loss you pay for in analyst time. Enforce a TTL and age indicators out automatically.