I think this isn't right because P(attack | alarm) is not the right quantity to study/optimize. That's what you optimize only if you believe that you "win" if y

I think this isn't right because P(attack | alarm) is not the right quantity to study/optimize. That's what you optimize only if you believe that you "win" if you guess right whether the attack was real. But that's unreasonable in this context. One must consider that installing sensors comes with a cost of its own (even in terms of having to come up with protocols for handling them), one must define one's own utility function for the different outcomes, and one must come up with a sensible decision rule. Estimating P(attack | alarm) is not quite the point. I think P(attack | alarm) > P(attack) does not by itself imply that paying attention to alarms is the right thing to do. > Remember that the penalty for missing a true alarm is possibly even worse that reacting to a false alarm. The outcome of reacting to a false alarm is exactly the same as the outcome of reacting to a true alarm, and, arguably, the same as the outcome of not reacting or reacting only partially—it's all -∞ basically.