Biometric authentication performance is often depicted by a DET curve. We show that this curve is dependent on the choice of samples available, the demographic composition and the number of users specific to a database. We propose a two-step bootstrap procedure to take into account of the three mentioned sources of variability. This is an extension to the Bolle \etal's bootstrap subset technique. Preliminary experiments on the NIST2005 and XM2VTS benchmark databases is encouraging, e.g., the average result across all 24 systems evaluated on NIST2005 indicates that one can predict, with more than 75\% of DET coverage, an unseen DET curve with 8 times more users. Furthermore, our finding suggests that with more data available, the confidence intervals become smaller and hence more useful.