Intruderrorry -

| Metric | Formula | Typical Benchmarks (Industry‑wide) | |--------|---------|-----------------------------------| | | FP / (FP + TN) | 0.5 % – 3 % for mature, tuned SIEMs; >10 % for out‑of‑the‑box NIDS. | | False Negative Rate (FNR) | FN / (FN + TP) | 1 % – 5 % for signature‑based IDS; up to 20 % for anomaly‑only systems. | | Precision | TP / (TP + FP) | 0.80 – 0.95 is considered good in SOCs. | | Recall (Sensitivity) | TP / (TP + FN) | 0.85 – 0.97 for well‑tuned EDR/EDR‑plus solutions. | | Mean Time to Detect (MTTD) | Average time from intrusion to first alert. | 30 min (high‑performing SOC) vs > 24 h (under‑resourced). | | Mean Time to Respond (MTTR) | Average time from alert to containment. | 4 h (target) vs > 48 h (high‑FPR environments). |