Detection Dial — where do you set the threshold?

Ten thousand events crossed the network today. Three of them were an attack. Your detector scores every event for suspicion; you choose the score at which it becomes an alert someone has to read. There is no setting that gives you both.

Today's ten thousand events, by suspicion score

0 · obviously routine100 · obviously hostile
ignored alerted — a human reads every one the three real intrusions

What you caught

What it costs

Alerts to read today—
Real intrusions caught—
Of every alert, this many are real—
Analyst time at 4 min each—
Analysts needed on shift—
—

“Just buy a better detector”

Drag the dial all the way along. There is nowhere good to stand. Three in ten thousand is a base rate of 0.03%, and a detector that is right nine times out of ten still drowns you in wrong answers, because it is wrong about a much larger pile. The stealthy intrusion is not beating your detector — it is beating your budget. That is why detection is never finished at the tool: it is finished at triage, correlation, and deciding what you have chosen not to look at.