Precision is the share of alerts that are real. Recall is the share of real problems that you caught. A stricter threshold raises the first and lowers the second. Choose by asking how many extra alerts you must review to find one more real issue, and whether that price is acceptable.
Definitions in plain words
- Precision: of what the tool flagged, how much was real.
- Recall: of everything real, how much the tool flagged.
You cannot judge a detector with one of them. A tool that flags nothing has perfect precision by default and zero recall. A tool that flags everything has perfect recall and awful precision.
A worked example
Illustrative numbers. A population has 1,000 items and 100 of them are truly bad. A detector has a score, and you can set three thresholds.
- High threshold: flags 50, of which 45 are real. Precision 90 percent, recall 45 percent.
- Medium threshold: flags 150, of which 80 are real. Precision about 53 percent, recall 80 percent.
- Low threshold: flags 400, of which 95 are real. Precision about 24 percent, recall 95 percent.
The marginal view
Do not compare totals. Compare steps.
- High to medium: 100 more flags, 35 more real. About 2.9 flags per additional real item.
- Medium to low: 250 more flags, 15 more real. About 16.7 flags per additional real item.
The first step is a bargain. The second is expensive. If one review takes 10 minutes, the second step costs about 167 minutes of review per additional real finding. Whether that is worth it depends on what a missed item costs.
How to choose
- Estimate the cost of a miss. A leaked production credential or a reachable remote code execution flaw justifies much more review time than a style issue.
- Estimate the cost of a review. Use real minutes.
- Pick the threshold where the marginal cost of one more true finding equals the cost you would accept for that class of issue.
- Use different thresholds for different classes. Strict where reviews are costly and misses cheap, loose where the reverse is true.
Two common traps
First, tuning the threshold on the same examples you report results on. You will overstate both numbers. Hold some data back.
Second, forgetting that precision depends on the base rate. If real issues become rarer in production than in your test set, precision falls without the detector changing at all. We cover that in why a 99 percent accurate detector still floods you.
Report both, with the count
A useful sentence: "At this threshold we flag about 150 items a week, roughly half are real, and we estimate we catch about 80 percent of real ones." That tells a reader the workload, the noise and the miss rate at once.
Quick check
Can I get both precision and recall near 100 percent?
Only when real and benign items are cleanly separable. In security, they overlap, so improving one usually costs some of the other.
How do I measure recall if I do not know what is missing?
Plant known issues, or use two independent methods and compare. See our post on estimating what two scanners both missed.
Last reviewed: 19 October 2026.
