You know of three missed intrusions, each surfaced by a different channel — can you state a false-negative rate?

## What a rate would require A false-negative rate is `misses / (misses + detections)`, and computing it honestly needs two things: the full set of intrusions in the period, and — if you intend to estimate rather than enumerate — a sample of that set drawn in a way whose selection probability you know. Three known misses give you neither. They are three observations of a population whose size is unknown, produced by samplers whose sensitivity is unknown and unequal. ## Why the three channels do not form a sample Suppose the three arrived as: one from a sharing-community notification naming your data, one from a hunt, and one from walking back a later incident. Each of those has a different, intrusion-dependent probability of firing at all: - outside notification is near-certain for an intrusion whose data gets published and near-zero for one whose objective was quiet persistence; - a hunt finding depends on retention, on which sources you collect, and on which hypothesis someone wrote down that quarter; - a back-timeline read is conditional on your having caught a later intrusion at all. So the probability of an intrusion appearing in your known-miss list is a function of what kind of intrusion it was. That is textbook selection bias, and it is not correctable, because correcting it would require knowing the selection probabilities — which requires knowing the population you are trying to measure. ## What you can legitimately say **A floor.** At least three intrusions were not detected in the period. This is a lower bound on misses, never an estimate of them. **A bound in the right direction.** If you detected `D` intrusions and know of `K` misses, then `D / (D + K)` is an *upper* bound on your true detection rate: the true miss count `M` satisfies `M >= K`, and increasing the denominator only lowers the ratio. Saying `our detection rate is at most 93%` is honest and useful; saying `our detection rate is 93%` is a fabrication. Interviewers listen specifically for this direction, because getting it backwards — presenting the figure as a floor, as if unknown misses could improve it — is the common error. **A statement about channels.** Every miss should carry the channel that revealed it. Three misses, all from outside notification, is a finding about your own machinery: internal discovery produced zero results, so the number of misses you can ever report is capped by other people's diligence. That is a defensible, actionable sentence, and it does not pretend to be a rate. **A statement about time.** For each known miss you can date the activity and the discovery, which gives an interval per case. Those intervals are also selection-biased upwards, so report them as individual cases rather than as an average that implies a population. ## Capture-recapture, and why it is intuition rather than arithmetic The classic estimator for an unseen population — `N ≈ n1 × n2 / overlap`, where two samplers found `n1` and `n2` items with `overlap` in common — is tempting here and must be handled carefully. It assumes a closed population, independent samplers, and equal catchability across members. All three fail: intrusions arrive and end continuously, the channels are correlated (a loud intrusion is more likely to be found by *every* channel), and catchability varies enormously by intrusion type. What survives is the direction of the intuition, and it is worth stating in an interview because it is uncomfortable and correct: **if two discovery channels keep finding almost entirely different intrusions, that is evidence the unfound population is large.** High overlap would suggest you are close to exhausting the set; disjoint results suggest you are sampling a fraction. Present it as a qualitative argument, never as a number on a slide. ## Buying a denominator The only way to get a real rate is to construct the population yourself: inject a chosen set of adversary behaviours into the estate under authorisation and count, for each one, whether telemetry was produced, whether something matched, and whether a case was worked. Now the denominator is exactly the set you injected, so the rate is arithmetic rather than inference. The cost is that this measures coverage of the behaviours *you chose*. It is a genuine, defensible, repeatable number about a population that is not the population of real intrusions, and it must always be reported with that caption. A team that presents `we detected 74% of executed behaviours` as `we detect 74% of attacks` has swapped one honest number for a dishonest one. ## Reporting it upwards The presentation that survives scrutiny has three parts: the count with provenance (`three known misses; all reported to us by third parties`), the bound with its direction (`our detection rate is at most X`), and a named proxy with its caption (coverage of executed behaviours, or of collection against the estate). Plus one sentence saying explicitly that a false-negative rate does not exist and why. That sentence is the hardest part and the most valuable. Inventing a rate feels cooperative in the meeting and is catastrophic the moment a fourth miss appears and the number moves without anything changing. Refusing to state a number you cannot support, while offering the two you can, is the behaviour the question is testing for.