Base rates

When something is rare, even a very accurate test produces mostly false alarms, and people find this deeply unintuitive.

A detection that is ninety-nine per cent accurate, applied to a million events containing ten malicious ones, buries those ten in thousands of false positives. No tuning of the rule fixes it, because the arithmetic is driven by how rare the thing is. It is the single most useful statistical idea in detection work.