What does this equation mean?

The arithmetic behind that claim generalizes directly to any detector, rule-based or AI-driven, and it is worth stating because it is the crux of why the two kinds of tooling are hard to compare on accuracy alone. If the base rate of genuine attacks among all monitored events is $\pi$ , and a detector has true-positive rate $\mathrm{TPR}$ and false-positive rate $\mathrm{FPR}$ , Bayes’ rule gives the probability that a flagged event is a real attack as $P(\text{attack} \mid \text{flagged}) = \frac{\pi \cdot \mathrm{TPR}}{\pi \cdot \mathrm{TPR} + (1-\pi)\cdot \mathrm{FPR}}$. When $\pi$ is very small, as it genuinely is in most enterprise traffic, even a detector with a low false-positive rate in isolation produces an alert stream that is mostly false alarms, because the enormous volume of benign events supplies far more raw false positives than the rare true attacks supply true ones. This is a property of the base rate, not of whether the detector is a hand-written rule or a trained model — but it explains why a rule-based system’s chief advantage has historically been precision on known, narrowly specified patterns, and why an AI-driven system’s chief promise is catching what no rule was written for, at the cost of a less predictable false-positive profile.