What is the false positive rate?
The false positive rate (FPR) is the share of actual negatives that a model wrongly labels as positive. If 10,000 endpoint events are benign and a threat-detection model raises alerts on 300 of them, the false positive rate is 0.03. The formula is false positives divided by the sum of false positives and true negatives. It is the complement of specificity, so the two always add up to one.
The false positive rate differs from the share of alerts that are wrong, which is one minus precision. A model can have a tiny false positive rate and still produce mostly false alarms when negatives vastly outnumber positives, because a small fraction of a huge number is still a large number.
Why the false positive rate matters
A managed service provider monitors endpoints for several hundred client companies. Each client generates thousands of benign events a day, so a false positive rate of 0.03 means a flood of tickets for its security analysts. The analysts start closing alerts without reading them, which is how real intrusions get missed. Lowering the false positive rate to 0.005 by raising the alert threshold cut the ticket volume to a level the team could actually investigate.
The false positive rate is also the horizontal axis of the ROC curve, which plots it against recall at every threshold. Reading the curve shows how much recall a team gives up for each reduction in false alarms.