The Cost of Quiet Alarms - Security Detection Limits and False Positive Costs

The Cost of Quiet Alarms - Security Detection Limits and False Positive Costs

While it is true that "if you can't prevent it, detect it," detection is always accompanied by false positives (FPs), and increasing sensitivity inevitably leads to lower specificity and more false alarms. NIST also points out that false positives and false negatives cannot be simultaneously reduced to zero, and one or the other must be sacrificed.

The "base rate trap" is particularly severe in low-prevalence areas. Screening in situations where positivity is extremely rare significantly reduces the positive predictive value (PPV), even with high specificity. For example, if 10 million people are tested even if the FP rate is 0.1%, 10,000 false alarms will be generated, resulting in enormous personnel response, cost, and social friction. This is a structural issue common to all fields, including medical inspection, airport security, and fraud detection.

The optimal detection point is defined as the threshold on the ROC curve and is calculated by Youden index (sensitivity + specificity - 1) or cost sensitive optimization. However, mathematical optimization alone is not sufficient. ENISA and OWASP treat false positives not as mere statistical errors, but as "the key to operational cost and reliability," and integrate them with monitoring, logging, and escalation design. ENISA and OWASP treat false positives as "the key to operational cost and reliability" rather than mere statistical errors and recommend integration with monitoring, logging, and escalation design.

In practice, it is important to (1) visualize the base rate and PPV/NPV, (2) analyze the strain of false positives and recalibrate the model, (3) distribute the response with staged alerts, and (4) redesign the defense deployment if it exceeds throughput. Ultimately, the goal of detection is not "zero misses," but rather "maximum realistic solutions to the extent possible while controlling false alarms. Detection is not mathematical, but a modern knowledge that questions the balance between operation and ethics.