Prompt-Volume-to-Alert Ratio
The prompt-volume-to-alert ratio is a signal-to-noise metric for agentic AI security operations: the number of AI prompts processed per time period divided by the number of actionable security alerts generated over the same period. It is the agentic-AI SOC analog to the traditional SIEM signal-to-noise ratio.
Definition
prompt_volume_to_alert_ratio = total_prompts_processed / actionable_alerts_generated
A high ratio indicates an effective behavioral detection layer — one that can process large volumes of agent activity and surface only the anomalies that require human attention. A low ratio indicates either insufficient detection (many anomalies missed) or, more commonly, excessive noise (analysts reviewing low-confidence alerts and burning out).
Production benchmark
The only quantified production example in this wiki as of May 2026 is from Salesforce’s Agentforce deployment, reported by Matt Rittinghouse and Millie Rittinghouse at [[unprompted-conference-march-2026|[un]prompted March 2026]]:
| Metric | Value |
|---|---|
| Daily prompts processed | ~1,800,000 |
| Daily actionable alerts | <30 |
| Ratio | ~60,000:1 |
| Detection model | Three-level ensemble (user / agent / org) behavioral anomaly detection |
| Detection latency | 12–24 hours (batch mode, as of March 2026) |
See “1.8M Prompts, 30 Alerts” for full methodology.
Why the metric matters
Traditional SIEM deployments are notoriously noisy — security teams frequently reduce alert volumes through aggressive suppression, at the cost of missing real events. Agentic AI workloads amplify the problem: agents generate 10–20× the log volume of humans over the same time window (per Miggo Security’s analysis of agent telemetry patterns, cited in Agent Observability).
Without purpose-built behavioral detection, a naive alerting policy on 1.8M daily prompts would produce an unworkable alert queue. The prompt-volume-to-alert ratio quantifies how effectively a detection stack tames this noise problem.
Relationship to maturity levels
In the Agentic AI Security CMM 2026, the prompt-volume-to-alert ratio is an observable output for the D7 (Observability & Monitoring) domain:
- L2: no systematic alerting on agent behavior; ratio is undefined (all alerts are manual ad hoc)
- L3: behavioral baselines exist; ratio is measurable but likely noisy during the first 14-day warm-up period for new agents
- L4: ensemble multi-level baselines; ratio is stable and tracked; warm-up period formalized in SOC playbook
- L5: hot-path inline inference; ratio maintained in real time; auto-containment triggers above threshold
No cross-vendor benchmarks available
The Salesforce 60,000:1 figure is the first and only published production benchmark for this metric as of May 2026. Whether this ratio is achievable across other agentic platforms, or what the lower bound of a “good” ratio is, remains an open empirical question. The ratio is sensitive to platform scale, agent behavioral diversity, and the aggressiveness of the detection threshold.