# What is a realistic false-positive rate for NDR?

There is no honest single number: it depends on your network, the tuning and how a false positive is counted, and vendor figures are rarely measured independently. A rate measured in a lab, on another company's traffic or over a different alert type tells you little about your Monday morning. Ask three questions of any figure: measured on whose data, over which alerts, and per what unit, such as per day, per host or per alert. The number that matters to you is practical: how many alerts reach a person each week, and what share of them lead to an action. Track that yourself from the first month. NetSenX does not quote a rate. A split-conformal layer bounds false positives among the alerts it surfaces once your own calibration data supports it, from benign traffic your team has labelled; until then the dashboard says so instead of showing a figure it cannot back.

FAQ: [Budget, staff and alert noise](https://netsenx.com/en/faq/budget) · https://netsenx.com/en/faq/what-is-a-realistic-false-positive-rate

## Read next

- https://netsenx.com/en/pricing
- https://netsenx.com/en/ndr-for-small-business

## Related questions

- [We get too many false positives. How do we tune without missing real attacks?](https://netsenx.com/en/faq/how-to-tune-false-positives-without-missing-real-attacks)
- [How long until a new security tool stops being noisy?](https://netsenx.com/en/faq/how-long-until-a-new-security-tool-is-quiet)
- [How much time does a small team need to run NDR?](https://netsenx.com/en/faq/how-much-time-does-a-small-team-need-to-run-ndr)
- [How much should a small business spend on cyber security?](https://netsenx.com/en/faq/how-much-should-a-small-business-spend-on-cyber-security)
- [What security spending should a small company never cut?](https://netsenx.com/en/faq/what-security-spending-should-a-small-company-never-cut)