Three incidents last quarter, five this one: is that a real change?

With small counts, a jump from 3 to 5 is usually noise. If the underlying rate is 4 per quarter, you would see 5 or more about 37 percent of the time. Before you change course, check whether the change is bigger than random variation, or wait for more data.

Counts behave like a Poisson process

Events that happen at some steady average rate, independently of each other, follow a Poisson distribution. Its useful property is that the standard deviation is about the square root of the average. If the typical quarter has 4 incidents, the spread is about 2.

So quarters of 2, 3, 4, 5 and 6 are all unremarkable. The data is a wobbling line, not a trend.

The check, with numbers

Suppose the true average is 4 per quarter. The chance of each count is:

• 0: about 2 percent
• 1: about 7 percent
• 2: about 15 percent
• 3: about 20 percent
• 4: about 20 percent
• 5 or more: about 37 percent
• 3 or fewer: about 43 percent

A count of 5 happens more than a third of the time with no change in anything. A count of 3 happens more than two in five times. A report that says "incidents up 67 percent" is true and nearly meaningless.

What to do with small counts

1. Pool more time. Use a rolling twelve months instead of a quarter. Doubling the window shrinks relative noise by about 30 percent.
2. Count something more frequent that tracks the same thing. Near misses, blocked attempts or failed checks happen far more often and give a clearer signal.
3. Show the range. If the average is 4 per quarter, a chart band of roughly 2 to 6 sets expectations for what counts as unusual.
4. Set a rule for action in advance. For example, act when a quarter exceeds the long run average by more than twice the square root of the average. For an average of 4 that is 8 or more.
5. Separate the question of what happened from why. Even a noisy count deserves an incident review for each event. The statistics only stop you from overreading the trend.

Percentages make it worse

A rate computed from a tiny denominator is dramatic and unreliable. Two of three phishing reports being real is 67 percent, and it is also nothing. Show the counts alongside any percentage, as in our look at percent versus count in security metrics.

When a change is real

Look for a shift that persists across several periods, a rise in a related measure, or a cause you can name, such as a new product exposed to the internet. Statistical noise rarely comes with a mechanism.

Quick check

Last reviewed: 19 October 2026.