What is a realistic false-positive rate for NDR?

There is no honest single number: it depends on your network, the tuning and how a false positive is counted, and vendor figures are rarely measured independently. A rate measured in a lab, on another company's traffic or over a different alert type tells you little about your Monday morning. Ask three questions of any figure: measured on whose data, over which alerts, and per what unit, such as per day, per host or per alert. The number that matters to you is practical: how many alerts reach a person each week, and what share of them lead to an action. Track that yourself from the first month. NetSenX does not quote a rate. A split-conformal layer bounds false positives among the alerts it surfaces once your own calibration data supports it, from benign traffic your team has labelled; until then the dashboard says so instead of showing a figure it cannot back.

← All 25 questions on Budget, staff and alert noiseAll topics