The Foundations Series

Four counts sit under every detection claim. If you can't name them, you can't argue with the metric.

What the four counts collapse into — and what each summary quietly throws away.

A 95%-accurate scanner that's usually wrong when it fires. Prevalence does that, and nobody prints it.

How a measurement lies while everyone involved is being honest.

Point a target at a number and watch the number stop meaning anything.

Same data, same result is table stakes. New data, same claim is where trust starts.

A benchmark too small to detect the difference it reports isn't evidence. How many cases is enough.

What a p-value actually says — which is less than you think, and still worth having.

A leaderboard is an ordering, not a measurement. First place says nothing about the gap.

Two raters agree 80% of the time — chance alone gets you most of the way there. κ subtracts the freebie.

A metric can give the same wrong answer every time. Consistent is not correct.

Downloads, stars, views — you're not measuring the thing, you're measuring its shadow.

One score means someone chose the weights. Find them before you trust the total.

Every benchmark has an answer key, and a person wrote it. “Correct” is a decision before it's a fact.

What's inside a severity score — and why a 9.1 can still be the wrong thing to fix first.

The weakness tree every scanner cites. Counting IDs without the hierarchy compares parents to their own children.

An awareness document, not a checklist — the difference changes what “covered” is allowed to mean.

Two ways a tool decides code is dangerous: follow the data, or match the shape. They fail differently.

Three names for reading code without running it. Where the categories end and the marketing begins.