DATA-SKEPTICISM5 MIN READ
The False-Positive Funnel
Use base-rate reasoning to explain why many alerts can be false positives when the event is rare.
A rare security event produces a large alert queue. Trace the funnel before deciding what the queue means. Rare event -> alert queue All employees checked population start with everyone Actual takeovers rare base rate small slice Model flags test result true and false mixed Confirmed incidents after verification decision-grade evidence rare underlying event alert mixture verified action Why can a large alert queue still contain many false positives?
Read the full lesson
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in