Precision
Of everything the control flagged, the share that was genuinely malicious — true positives divided by all positives. It answers "when this alerts, should I believe it?". Precision is what analysts feel, because low precision means alert fatigue, and it is the number most often left out of marketing claims since it can only be measured against a benign corpus somebody had to build.
See also recall · false positive · hard negative
Related terms
-
Recall
Testing & measurement
Of all the real attacks in the corpus, the share the control caught. It is the number vendors quote, and on its own it means very little: recall is…
-
False positive
Testing & measurement
Benign activity flagged as malicious. In an agent security control this is the failure mode that actually kills deployments: a tool that blocks legitimate…
-
Hard negative
Testing & measurement
A benign sample deliberately shaped like an attack — a security engineer legitimately asking about base64 decoding, a role-play prompt with no harmful…
Testing & measurement
The words that decide whether a published detection number is evidence or decoration. Most vendor numbers in this space are quoted without any of them; see how we test for how these are applied in practice.