Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →In the seven-day Kubernetes security-detector soak test described by Eliot Ferstl, every detector trip during the measurement window counts as a false positive because the run deploys no attacks. The rules also keep alerts, evidence records, isolations, and pod terminations separate, and count only hours when the detection ensemble is online. The published article sets pass criteria, not completed-test results.
What counts as a false positive in this test?
The test covers 94 protected pods across 14 namespaces for seven days. Because no attacks are deployed, the labeling rule is direct: every detector trip during the measurement window is a false positive. The authors do not remove trips later through adjudication.
As an Amazon Associate I earn from qualifying purchases.
That definition is specific to this soak test. A rate cannot be interpreted without knowing what event is labeled, how it is labeled, and what activity the test includes. Ferstl puts the point this way: “A false positive rate without an event definition, a denominator, and a labeling method is marketing.”
Free tools Windows power users keep installed
One-click scans. No signup required.
Why are alerts, evidence, isolation, and termination counted separately?
A detector can fire without producing a signed evidence record, and a record does not necessarily lead to isolation or termination. The test tracks four distinct outcomes because they represent failures with different costs:
#1 Best Overall
- Detector fired: a trip occurred. In this no-attack run, every such trip is labeled a false positive.
- Signed evidence record produced: evaluated on the statistical plane, where the stated pass bar is at most 0.1 false evidence records per pod-hour.
- Isolation applied: evaluated as a response action, with a stated pass bar of at most 0.01 false isolations per pod-hour.
- Pod terminated: the stated pass bar is zero false terminations.
These are the test’s criteria, not measured rates or proof that any criterion was met. The zero-termination bar also has an architectural caveat: statistical events are capped below termination by design. That means a zero can partly reflect the response architecture rather than the detector’s model quality.
Which pod-hours go into the denominator?
The denominator includes pod-hours only while the detection ensemble is online. Cold-start hours, when the sidecar cannot act, and post-churn relearning windows are excluded. The campaign includes pod recreation, pod termination, and sidecar restarts on a 12-hour rotation.
Excluding inactive and relearning periods reduces the denominator. For a fixed number of counted events, a smaller denominator produces a higher calculated rate; readers should therefore check these exclusions before comparing the reported rates with another test.
Recommended Free Tools
Why do configuration and build details matter?
The fleet includes an out-of-the-box configuration cohort and a cohort with integrity baselining armed. Half of the armed group required a privilege grant that the authors say most customers would not make. Those cohorts are intended to be reported separately, rather than blended into a single rate that could hide configuration differences.
Rank #3
The measured build is described as the released chart paired with a staging-signed sidecar carrying the same detector code as the release. The artifact is therefore not simply described as a release-signed sidecar. Any result should be read alongside that build status and the cohort configuration, rather than treated as a universal rate for every deployment.
How does the test guard against a misleading zero?
With no attacks deployed, a broken counter or misclassified event could make performance appear perfect. The authors call this risk a “wrong zero.” Their analyzer requires every detector trip to be claimed by a named event class. Any unclaimed remainder signals a gap in the event taxonomy, not a clean result; the authors say they will not publish a zero that cannot be cross-checked.
What should you ask when comparing false-positive rates?
A rate from another security detector is comparable only if its underlying counting choices are clear. Ferstl’s practical advice is to ask for the event definition, denominator, and a way to tell whether a zero is wrong. For a more complete comparison, check:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Which event is labeled false positive, and whether events are reclassified after review.
- Whether the rate counts detector trips, evidence records, isolations, terminations, or a combination.
- How the denominator is calculated, including inactive hours and relearning exclusions.
- Which configuration cohort is measured, including any required privileges.
- Which artifact and signing status were tested.
- How unclaimed or misclassified events are detected before a zero is reported.
Are the pass bars results?
No. The article published the test size, labeling rules, and pass bars, but says results were not yet available when it was posted on August 26, 2026. It therefore does not establish whether the system met any of the stated criteria.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
