> How do you judge whether 20,515 is a large number or a small number?

It’s a trade-off between false positives and false negatives, and the budget you have to investigate alerts.

https://en.wikipedia.org/wiki/Receiver_operating_characteris...