Measure how much of your threat-intel indicator set ever fires, how precise the matches are, and how much feed decay costs.
Hit rates on large commodity feeds are typically far below 1%, which is expected rather than alarming: most indicators describe infrastructure you will never be targeted by. The number that decides whether to alert on a feed is precision — what share of matches were real — combined with cost per true positive. Indicator feeds are bought by volume and consumed by relevance, and a quarter-million-indicator subscription producing twenty-two real detections a period is a spend decision disguised as a security control.
IOC Match Rate
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events.
Decay and cost
Effective indicators = set size × (1 − stale share); feed cost per true positive = annual feed cost ÷ confirmed matches.
Indicator hit rate = distinct indicators matched ÷ indicators in the set. Match precision = confirmed malicious matches ÷ total match events. Hit rates on large commodity feeds are typically far below 1%, which is expected rather than alarming: most indicators describe infrastructure you will never be targeted by. The number that decides whether to alert on a feed is precision — what share of matches were real — combined with cost per true positive.
Indicator feeds are bought by volume and consumed by relevance, and a quarter-million-indicator subscription producing twenty-two real detections a period is a spend decision disguised as a security control.
This calculator takes 7 inputs: Indicators in the active set, Distinct indicators that matched, Match events raised in the period, Matches confirmed malicious, Events evaluated against the set, Indicators past their useful life, Annual cost of the intel feeds. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No. Use them as enrichment — tag the event, raise the risk score, make them searchable — and reserve alerting for high-confidence, recently observed indicators tied to a specific campaign. This alone removes most intel-driven noise.
Because commodity IPs and domains rotate in days. Matching against expired indicators produces stale hits on infrastructure now hosting something innocuous, which is precision loss you pay for in analyst time. Enforce a TTL and age indicators out automatically.