Share of anomaly/misuse alerts confirmed as genuine issues upon review, rather than false alarms.
Formula
Confirmed-genuine alerts ÷ total alerts raised × 100
Illustrative target
Directional only — no established benchmark exists
KPI cautions1
Driven to 100% by tuning anomaly-detection thresholds so conservatively that almost nothing gets flagged — trivially precise because the alert volume approaches zero, not because detection is genuinely good.