Apply Bayes to detection rates: turn true and false positive rates plus base rate into real alert precision and analyst load.
Precision is not the detection rate. Because benign events outnumber malicious ones by tens of thousands to one, even a very small false positive rate produces far more false alerts than the detector produces true ones. With a 0.02% base rate, 92% sensitivity and a 0.5% false positive rate, fewer than four alerts in a hundred are real. This is the base rate fallacy, and it is why analysts stop trusting a detection that management believes is 92% accurate — the accuracy claim describes sensitivity, not the odds that any individual alert matters.
Threat Detection Rate
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting.
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting. Precision is not the detection rate. Because benign events outnumber malicious ones by tens of thousands to one, even a very small false positive rate produces far more false alerts than the detector produces true ones. With a 0.02% base rate, 92% sensitivity and a 0.5% false positive rate, fewer than four alerts in a hundred are real.
This is the base rate fallacy, and it is why analysts stop trusting a detection that management believes is 92% accurate — the accuracy claim describes sensitivity, not the odds that any individual alert matters.
This calculator takes 5 inputs: Events evaluated per day, Share of events that are genuinely malicious, True positive rate (detection sensitivity), False positive rate, Analysts on rotation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Two levers, and only one of them is usually available. Cutting the false positive rate is the powerful one — precision scales roughly inversely with it, and the calculator shows the rate you would need for even 50% precision. The other is raising the base rate by narrowing scope: run the detection only on high-value assets or on traffic that already passed a cheaper filter, so the population you evaluate is far more likely to contain something real.