Threat Detection Rate Calculator
Apply Bayes to detection rates: turn true and false positive rates plus base rate into real alert precision and analyst load.
About Threat Detection Rate Calculator
Precision is not the detection rate. Because benign events outnumber malicious ones by tens of thousands to one, even a very small false positive rate produces far more false alerts than the detector produces true ones. With a 0.02% base rate, 92% sensitivity and a 0.5% false positive rate, fewer than four alerts in a hundred are real. This is the base rate fallacy, and it is why analysts stop trusting a detection that management believes is 92% accurate — the accuracy claim describes sensitivity, not the odds that any individual alert matters.
Formula
Threat Detection Rate
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting.
- TPR
- Probability the detector fires on a genuinely malicious event
- FPR
- Probability the detector fires on a benign event
- base rate
- Prior probability that any given event is malicious
Worked example
With the default values below, Threat Detection Rate Calculator returns Alert Precision of 3.55%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Events evaluated per dayaccepts 1–10,000,000,000 events
- 5,000,000 events
- Share of events that are genuinely maliciousaccepts 0–100 %
- 0.02 %
- True positive rate (detection sensitivity)accepts 0–100 %
- 92 %
- False positive rateaccepts 0–100 %
- 0.5 %
- Analysts on rotationaccepts 1–500 analysts
- 6 analysts
Results
- Alert Precision
- 3.55%
- Alerts per Day
- 25,915
- True Positives per Day
- 920
- False Positives per Day
- 24,995
- Missed Detections per Day
- 80
- Recall
- 92.00%
- F1 Score
- 6.84%
- Alerts per Analyst Hour
- 180.0
- False Positive Rate for 50% Precision
- 0.0184%
Step by step
- 1Values used
- 2Threat Detection Rate
- 3Alert Precision= 3.55
- 4Alerts per Day= 25,915
- 5True Positives per Day= 920
- 6False Positives per Day= 24,995
- 7Missed Detections per Day= 80
- 8Recall= 92.00
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 4 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Threat Detection Rate calculated?
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting. Precision is not the detection rate. Because benign events outnumber malicious ones by tens of thousands to one, even a very small false positive rate produces far more false alerts than the detector produces true ones. With a 0.02% base rate, 92% sensitivity and a 0.5% false positive rate, fewer than four alerts in a hundred are real.
Why does Threat Detection Rate matter?
This is the base rate fallacy, and it is why analysts stop trusting a detection that management believes is 92% accurate — the accuracy claim describes sensitivity, not the odds that any individual alert matters.
What values do I need to enter?
This calculator takes 5 inputs: Events evaluated per day, Share of events that are genuinely malicious, True positive rate (detection sensitivity), False positive rate, Analysts on rotation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I actually improve precision?
Two levers, and only one of them is usually available. Cutting the false positive rate is the powerful one — precision scales roughly inversely with it, and the calculator shows the rate you would need for even 50% precision. The other is raising the base rate by narrowing scope: run the detection only on high-value assets or on traffic that already passed a cheaper filter, so the population you evaluate is far more likely to contain something real.