Industry: Defense
Product: ModelRisk
Application: Missile defense system performance evaluation under uncertainty

60% Raid Annihilation, but a P99 of 7 Leakers: Sizing a Layered Interceptor Engagement

A coordinated raid of 20 incoming missiles is met by a layered interceptor battery firing shoot-shoot-look — up to three interceptors per target, each with a mean single-shot kill probability of 0.75. The staff estimate said the battery would, on average, let through fewer than one missile. The Monte Carlo agreed on the average — and then showed that 1 raid in 100 produces 7 or more leakers, because every interceptor in a salvo flies through the same sky.

That tail is invisible to a calculation that treats each interceptor as an independent coin flip. The single number that mattered for the architecture decision was not the mean: it was the 60.3% probability of zero leakers (raid annihilation) against a 20-missile raid, and how fast that probability climbed as interceptors-per-target rose.

Why a point estimate fails here

Both models below have an essentially identical mean of ~0.84 leakers (0.84 correlated, 0.83 independent). They are not remotely the same defense problem.

• Independent-Pk model (the textbook): each interceptor draws its own kill probability. Leakers collapse toward a thin binomial — P99 of just 3 leakers. This is the CLT washing the risk away.
• Correlated-conditions model (reality): the engagement conditions on the day — jamming, closing geometry, sensor-lock quality, weather — apply to the whole salvo at once. We draw one engagement-condition kill probability per raid from a Beta(6, 2) (mean 0.75, with a genuine left tail down toward 0.40 on a bad day) and share it across every interceptor in that raid. Within the shared condition, each intercept is an independent Bernoulli. P99 jumps to 7 leakers — the same average, more than double the tail.

We imposed that correlation explicitly and verified it empirically: the realised mean inter-target leak correlation is 0.089 under the shared-conditions model versus 0.000 under independence. A bad-conditions raid leaks several missiles together; the independent model can never produce that joint failure. A point estimate of 0.84 leakers would have sized the battery for a war it will not fight.

The model behind the chart

The raid arrives as a group of N targets. Each target is engaged shoot-shoot-look: fire one interceptor, if it misses fire a second, look, then optionally a third. Two random events gate every shot:

• Launch reliability — the interceptor actually leaves the rail and flies, Bernoulli(0.95) per round, independent.
• Kill probability Pk — Beta(6, 2) drawn once per raid and shared across all interceptors in that raid (the correlated-misses mechanism).

A leaker is a target that survives all three interceptor attempts. Across 200,000 simulated raids the headline outputs are a mean of 0.84 leakers, a P95 of 4, and a P99 of 7.

How deep the salvo has to be

The architecture question is not "what is the average?" but "how many interceptors per target buy raid annihilation?" The sweep answers it directly.

The marginal interceptor is sharply diminishing: going from one to two shots buys 28 points of annihilation probability; the fourth-to-fifth interceptor buys under 10. Even at five interceptors per target the battery does not clear a 90% annihilation bar against this raid — under correlated conditions, the residual bad-day tail is stubborn.

Bigger raids push the whole curve right

Holding the salvo depth at three interceptors per target, the leaker CDF shifts steadily right as the raid grows:

• 12-missile raid: mean 0.50 leakers, P90 = 2, P(zero leakers) = 70.2%.
• 20-missile raid: mean 0.84 leakers, P90 = 3, P(zero leakers) = 60.3%.
• 30-missile raid: mean 1.25 leakers, P90 = 4, P(zero leakers) = 52.3%.

Raid saturation is not linear in leakers — but the probability of perfect defense erodes fast, which is the metric that matters when one leaker is one city block.

What actually moves the leaker count

Re-simulating each input across its plausible range, ranked by effect on mean leakers (baseline 0.84):

• Interceptors per target (2 to 4): ±0.82 leakers — salvo doctrine dominates.
• Single-shot Pk (0.65 to 0.85): ±0.72 leakers — interceptor lethality is the close second.
• Engagement-condition spread (tight to wide): ±0.26 leakers — holding the mean Pk fixed, just widening the shared-conditions distribution adds leakers. This bar would not exist in an independent model; it is the cost of correlation, quantified.
• Interceptor launch reliability (0.88 to 0.99): ±0.23 leakers.
• Raid size (16 to 24 missiles): ±0.16 leakers.

What the model changed

• Salvo doctrine set to three interceptors per target for the design-threat 20-missile raid, accepting a 60% annihilation probability as the credible floor rather than chasing a 90% number that the correlated tail makes uneconomic.
• A reserve-allocation rule keyed to the P99 of 7 leakers, not the mean — point-defense and consequence-management resources are sized for the bad-conditions raid, not the average one.
• Engagement-condition spread elevated to a tracked program risk: the model showed that tightening conditions dispersion (better all-weather sensors, jam resistance) removes leakers even when mean Pk is unchanged — a sensor investment the independent model would have scored as worthless.

ModelRisk Functionality Used

• Shared per-raid engagement-condition factor (Beta(6, 2) drawn once and broadcast across the salvo) to impose correlated interceptor misses — the mechanism that turned a thin P99 of 3 into a fat P99 of 7 at an unchanged mean of 0.84.
• Empirical correlation verification: the realised inter-target leak correlation (0.089 shared vs 0.000 independent) computed from a survival matrix, proving the dependency was actually present and not just declared.
• Shoot-shoot-look engagement logic as custom per-target simulation with launch-reliability and kill-probability gates on every round.
• Interceptors-per-target and raid-size sweeps re-running the full simulation to map P(zero leakers) as a decision surface rather than a single answer.
• Tornado on mean leakers that isolated engagement-condition spread as a driver independent of mean Pk — a sensitivity only a correlated model can surface.

Against a coordinated raid the right question is not "how many leakers on average?" but "what is the probability of zero, and how heavy is the tail when every interceptor shares the same bad day?" — and only a correlated Monte Carlo answers it.