Threat Detection Rate Calculator
Apply Bayes to detection rates: turn true and false positive rates plus base rate into real alert precision and analyst load.
Inputs
The base rate. In network telemetry this is usually well under 0.1%.
Alert Precision
3.55%
Alerts per Day
25,915
True Positives per Day
920
False Positives per Day
24,995
Missed Detections per Day
80
Recall
92.00%
F1 Score
6.84%
Alerts per Analyst Hour
180.0
False Positive Rate for 50% Precision
0.0184%
Step by step
Values used
Events evaluated per day = 5,000,000 events; Share of events that are genuinely malicious = 0.0200 %; True positive rate (detection sensitivity) = 92 %; False positive rate = 0.5000 %; Analysts on rotation = 6 analysts
Threat Detection Rate
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting.
Alert Precision
= 3.55
Alerts per Day
= 25,915
True Positives per Day
= 920
False Positives per Day
= 24,995
Missed Detections per Day
= 80
Recall
= 92.00
How it works
Precision is not the detection rate. Because benign events outnumber malicious ones by tens of thousands to one, even a very small false positive rate produces far more false alerts than the detector produces true ones. With a 0.02% base rate, 92% sensitivity and a 0.5% false positive rate, fewer than four alerts in a hundred are real. This is the base rate fallacy, and it is why analysts stop trusting a detection that management believes is 92% accurate — the accuracy claim describes sensitivity, not the odds that any individual alert matters.
Formula
Threat Detection Rate
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting.
- TPR
- Probability the detector fires on a genuinely malicious event
- FPR
- Probability the detector fires on a benign event
- base rate
- Prior probability that any given event is malicious
Frequently Asked Questions
How is Threat Detection Rate calculated?
precision = TPR × base rate ÷ (TPR × base rate + FPR × (1 − base rate)) — Bayes' theorem applied to alerting. Precision is not the detection rate. Because benign events outnumber malicious ones by tens of thousands to one, even a very small false positive rate produces far more false alerts than the detector produces true ones. With a 0.02% base rate, 92% sensitivity and a 0.5% false positive rate, fewer than four alerts in a hundred are real.
Why does Threat Detection Rate matter?
This is the base rate fallacy, and it is why analysts stop trusting a detection that management believes is 92% accurate — the accuracy claim describes sensitivity, not the odds that any individual alert matters.
What values do I need to enter?
This calculator takes 5 inputs: Events evaluated per day, Share of events that are genuinely malicious, True positive rate (detection sensitivity), False positive rate, Analysts on rotation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I actually improve precision?
Two levers, and only one of them is usually available. Cutting the false positive rate is the powerful one — precision scales roughly inversely with it, and the calculator shows the rate you would need for even 50% precision. The other is raising the base rate by narrowing scope: run the detection only on high-value assets or on traffic that already passed a cheaper filter, so the population you evaluate is far more likely to contain something real.