≈

The passage around this formula

A catalogue is not a triage plan. The ten differ enormously in how much damage accrues before anyone notices, and instrumentation effort should follow that rather than follow which failure is most interesting to write about. For a mode i with arrival rate $\lambda_i$ , mean time to detection $\tau_i$ , and cost per undetected instance $\ell_i$ , the loss accrued before intervention is approximately $L_i \approx \lambda_i \, \tau_i \, \ell_i$. and the marginal value of building a detector is whatever it removes from $\tau_i$ . Written this way, the ranking departs sharply from intuition, because $\tau_i$ spans several orders of magnitude across the ten while $\lambda_i$ and $\ell_i$ vary far less.

Read this part in the article →