What this split does and doesn’t say
A ratio of roughly 78% allowed to 22% blocked describes how permissive the existing rule set is, not how accurate it is. A firewall can block a large share of traffic and still let scored, corroborated threats through, because static rules and geo/rate-based filters aren’t built to evaluate an indicator’s Crime Score — they enforce whatever was configured into them at some earlier point, independent of what the Alliance currently knows about a given source.Why this is the starting number
Every other breakdown in this analysis — clean versus malicious, severity bands, unique threat actors — is a further cut of the 16,055 allowed events. This chart is the denominator everything else is measured against, and it’s built entirely from traffic the client already logs, without any change to the existing firewall configuration.Proof of Value engagements produce this same split against a client’s own edge traffic. Start a Proof of Value.