At about twenty to four most weekday afternoons, my house goes off like a stadium.
The delivery driver has turned into the street. Not the driveway. The street. Both dogs are at the window, then the door, then the window again, producing a noise you could use to break up concrete. By the time the parcel hits the mat they have escalated to the sound they normally reserve for a home invasion.
Nothing is wrong. Nothing has ever been wrong. In four years of this, the delivery driver has been a threat exactly zero times.
That is a false positive rate of one hundred per cent on the most repeated event in the detector's life. No vendor on earth would ship it.
And I would still back those dogs over most of the security products I have paid for.
Let me be fair about how bad they are, because I do not want to oversell my own dogs.
They bark at possums. They bark at the wind moving the side gate. They bark at a plastic bag with ideas above its station, at the neighbour's car, at a bird that landed on the roof without sufficient respect, and, my favourite, at each other, having forgotten within about a second who started it.
Score them the way we score detection systems and the numbers are appalling. Nearly everything they raise is nothing. They would be pulled from production, and somebody would write an incident report about how they were ever approved.
And yet. Every single time, I get up and look.
That is the part I cannot get around. Thirty years in this industry and I have never responded to a security alert the way I respond to a dog.
The other side of my working life looks nothing like that.
I have sat in front of consoles producing several hundred alerts a day. Correlated, prioritised, colour coded, beautifully presented. And I have watched the people who owned those consoles do the only rational thing available to them, which was to stop reading them.
Nobody announces that. There is no meeting where a team formally agrees to ignore the alerting system. It happens by drift.
Someone writes a filter to hide the noisy rule. Someone else acknowledges a batch of forty without opening any of them, because the forty before that were nothing. A rule gets disabled on a Friday because it fired during a change window, and it is never turned back on, and eighteen months later nobody in the building knows it is off.
Then something real happens, and afterwards you find it in the logs, sitting there patiently, correctly detected at 2am, displayed to nobody.
That is the failure mode. Not that the tool missed it. The tool caught it. The organisation had quietly, sensibly, stopped listening.
The standard was never the ambiguous part. The Australian Cyber Security Centre's own guidance is explicit that event logs have to be analysed in a timely manner, not merely captured and retained. Every organisation I am describing had the capturing comprehensively solved.
So why do the dogs get away with it?
Two reasons, and neither one is accuracy.
The first is that the bark is not one signal. There is the delivery bark, which is enthusiastic and basically social. There is the possum bark, which is aimed upwards and faintly embarrassed. And there is a third one, lower and shorter with a gap in it, which I have heard perhaps five times in four years, and which has me on my feet before I have decided to stand up.
I cannot tell you that all five of those turned out to be something real. On two of them I never found out what they were. What I can tell you is that in four years the rare bark has never once been spent on the delivery driver.
That is the part that matters. The detector is noisy, but it is not flat, and it does not inflate. There is no quota to hit and no renewal coming up.
The second reason is cost. Checking a dog costs me four seconds and a walk to a window. That is the entire price of a false positive. At four seconds I can afford forty false positives a day and never think about turning the system off.
Most security tooling has this backwards. It optimises accuracy on paper and ignores the price of answering, and the price of answering is where real detection dies. An alert that takes twenty minutes to triage has a completely different economy to one that takes four seconds, even when the two are equally correct. The vendor is not measured on the twenty minutes. You are.
There is a number nobody puts on a datasheet, and it is the only one I care about now. Not detection rate. Not false positive rate. The rate at which a human being still bothers to check.
Your real detection is that rate multiplied by your accuracy. A tool that is right about ninety-nine alerts in a hundred and gets opened one time in ten is worse than a scruffier one that is right about seven in ten and gets opened every time. Every datasheet I have read sells you the first number. I have never seen the second one mentioned, and the second one is decided in your building, by tired people, on a Tuesday.
You can measure it this afternoon. Count how many alerts you closed last week without opening a single one of them.
You already know why they all arrive marked high. I have never met a vendor who wanted to be the one who labelled the real breach informational. So everything is urgent, and when everything is urgent the word stops carrying information. You know what happens to the smoke alarm that goes off every time you make toast. It ends up in a drawer with the battery out, and it is still in the drawer on the night it is needed.
My dogs have never had a marketing department. That is most of their advantage.
I should be honest about the limits, because they are real and they are large.
The dogs cover the front of the house and nothing else. They cannot be tuned, they cannot be audited, they keep no logs, and they can be defeated completely by one person with a sausage. I have written elsewhere about the other half of this problem, the deterrence half, where your house sits in the sort order when somebody is choosing a target. This is a different argument. This one is about what happens when something is already inside, and whether anybody notices.
What the dogs get right is not the detection. It is the relationship. They have earned a response from me by being cheap to check and honest about severity, and they have held onto that response for years while being wrong nearly every day.
At twenty to four this afternoon the dogs will go off again, they will be wrong again, and I will get up anyway. I would take that over a quiet console nobody opens. The last alert your system raised: who actually got up and walked to the window? And if the honest answer is nobody, what exactly are you paying for?