Detection Ratio Metrics

A detection engineering team monitors an environment that evolves over time. Generally, that environment grows as the enterprise hires more employees and expands its cyber footprint. To adjust for this we must measure a detection engineering team’s output in a way that incorporates enterprise growth. We are going to build upon the two previous posts (Detection Visibility Metrics & Detection Pipeline Metrics). These three posts intentionally align since it’s critical we keep the same terminology when referencing the entire detection ecosystem.

Basic Detection Metrics

We need a way to measure our success beyond basic alert counts which are just numbers without any context. The only way to show improvement for numbers without any context would be to reduce alert counts. We all know it is not that simple when most environments are growing. As the enterprise expands alert counts will also increase. Let’s start with an example:

At first glance it appears we are getting worse! It will look that way if we strictly look at the alert totals. There is much more to the story when we incorporate the growth of the environment we are monitoring.

The Detection Ratio

We can incorporate environment change into our metrics by creating a ratio for triggered alerts to monitored objects. This will allow us to both measure our improvement as the enterprise grows and even forecast alert output to ensure we have the appropriate staffing in place to monitor ahead of time. I will share a preview of the final metrics before I walk through the steps. The chart below is specific to endpoints.

From the chart we can make the following conclusions:

• From 2023 to 2025 we reduced our triggered alert counts per endpoint from 0.026 to 0.015. The monthly average triggered alerts increased due to the amount of endpoints increasing within the enterprise.
• We can forecast triggered alert counts when the enterprise grows in 2026 since we have the alert ratio per endpoint for 2025. Forecasting will allow the monitoring team to prepare ahead of time.
• We can easily speak to the metrics with other teams and leadership by saying we have X alerts per month per 100 endpoints. For example in 2025 we generated approximately 1.5 alerts per 100 endpoints per month.

Detection Ratio Categories

We will need to create high level buckets to define a monitored object. I will propose some but you should adapt these to better fit your environment.

• Endpoint — count of endpoints being monitored within your organization.
• Network — sum of monitored network throughput within your organization.
• Identity — count of monitored users within your organization.

Detection Ratio Data Sources

The next step will be to split out all triggered alerts by the categories above. I have listed some example data sources below.

Endpoint — sum of triggered alerts from endpoint related data sources.

• Antivirus, Endpoint Detection & Response (EDR), Endpoint Protection Platforms (EPP), Application Control, Operating System Events, PowerShell events, etc.

Network — sum of triggered alerts from network related data sources.

• Web Proxies, Network Intrusion Detection Systems (IDS/IPS), Web Application Firewalls, VPN, Netflow, etc.

Identity — sum of triggered alerts from identity related data sources.

• Email, Directory Services (Active Directory), Privileged Access Monitoring, Entra ID Protection, etc.

NOTE: This will get trickier with more complex detection correlation across data sources but realistically for metrics we need to summarize the data. If we do not summarize our monitoring when reporting up we will be deep in weeds with leadership that simply does not have the time.

Detection Ratio Calculations

Below are the generic formulas to calculate the ratios. The objects will be what makes the most sense for your organization.

Alerts per Object = Object Alert Totals / Object Count

Alerts per 100 Objects = Object Alert Totals / (Object Count / 100)

Next Year Forecast = Object count * Alerts per Object [Current Year Ratio]

Here are some examples with fabricated alert counts for the categories I listed above.

Endpoint — Alerts Per Endpoint

Alerts per Endpoint = Endpoint Alert Totals / Endpoint Count

Alerts per 100 Endpoints = Endpoint Alert Totals / (Endpoint Count / 100)

Year 2026 Forecast = Endpoint count * Alerts per Endpoint [Year 2025 Ratio]

Network — Alerts per GB transferred

Alerts per GB Transferred = Network Alert Totals / (Network Ingress + Network Egress)

Alerts per 100 GB transferred = Network Alert Totals / ((Network Ingress + Network Egress) / 100)

Year 2026 Forecast = (Network Ingress + Network Egress) * Alerts per GB Transferred [Year 2025 Ratio]

Identity — Alerts per User

Alerts per User = Identity Alert Totals / User Count

Alerts per 100 User = Identity Alert Totals / (User Count / 100)

Year 2026 Forecast = User Count * Alerts per User [Year 2025 Ratio]

Detection Ratio Visualization

Next lets graph an example showing how these numbers fit together. Below you can see clearly that the Detection Engineering team is improving by reducing the detection ratio (green line) even while the enterprise is growing (blue line). The alert counts (red line) fluctuates which will certainly be noticed by leadership. If we only had the alerts totals (red line) there would be some frantic explaining to do.

The detection landscape is always changing so we need to ensure when we measure it we incorporate that factor. If we do not then we may be improving but the metrics will not reflect it. As long as the final numbers are simple to communicate we are free to calculate them in a way that accounts for the environment change. Give these ratios a shot to see how your detections have improved over time.

Sources and Additional Reading

https://detect.fyi/detection-visibility-metrics-577fa1d63696

https://medium.com/@plantainstan/detection-pipeline-metrics-ae6757d7e6b2