4. Supervised Learning for Threat Detection

Introduction and Context

Cybersecurity produces large volumes of labelled and potentially labelable data: malicious and benign files, phishing and legitimate messages, fraudulent and normal transactions, vulnerable and non-vulnerable assets, and network sessions associated with attacks or routine activity. Supervised learning uses such examples to learn a mapping from observed features to a target outcome. In threat detection, that outcome may be a class—such as malware or benign software—or a numerical value—such as a vulnerability-risk score or expected loss.

The attraction of supervised learning is practical: security teams can convert historical investigations, incident records, malware repositories, vulnerability assessments, and analyst decisions into repeatable detection models. However, cybersecurity is an adversarial and changing environment. Labels may be incomplete, attacks may be deliberately designed to evade models, and the cost of a false negative may be much greater than that of a false positive. Consequently, successful application requires more than selecting an algorithm. It requires careful problem formulation, representative data, leakage-resistant evaluation, operational thresholds, human oversight, and continuous monitoring.

This chapter develops the principal supervised methods used in cybersecurity: regression, decision trees, random forests, support vector machines, boosting, and ensemble approaches. It connects their mathematical intuition with applications in malware classification, phishing detection, fraud, spam filtering, vulnerability prioritization, and intrusion detection.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Distinguish classification, regression, ranking, and detection problems in cybersecurity.

2. Explain how decision trees, random forests, support vector machines, boosting, and ensembles make predictions.

3. Select features, labels, metrics, and validation strategies appropriate to security data.

4. Apply supervised learning concepts to malware, phishing, fraud, spam, vulnerability, and intrusion cases.

5. Interpret false positives, false negatives, class imbalance, concept drift, and adversarial risk.

6. Design a responsible operational workflow for deploying and governing a threat-detection model.

From Security Question to Learning Problem

A supervised learning system consists of observations, features, labels, a learning algorithm, and a decision rule. Let a dataset be represented as \(D = \{(x_i,y_i)\}_{i=1}^{n}\), where \(x_i\) is a vector of observed characteristics and \(y_i\) is the known outcome. A model \(f(x)\) is trained to approximate the relationship between them.

In binary classification, the target may be malicious versus benign. In multiclass classification, a file might be classified as ransomware, spyware, downloader, or benign. Regression predicts a continuous value, such as the probability-adjusted risk of a vulnerability, expected financial loss from a transaction, or the number of suspicious events expected during a time interval. Ranking orders items for analyst attention; although often implemented with classification or regression, its operational objective is prioritisation rather than a simple yes-or-no decision.

A probability output is not itself a final security action. A security team must choose a threshold. If a classifier estimates a 0.72 probability that a message is phishing, the organization may quarantine it, request additional authentication, or send it for review. The threshold depends on the relative cost of missed attacks, unnecessary interruptions, response capacity, and regulatory obligations.

Labels and Their Imperfections

Labels can originate from confirmed incident investigations, sandbox verdicts, user reports, payment chargebacks, vulnerability exploitation evidence, or analyst adjudication. They are rarely perfect. A file labelled benign may not have been fully examined; an intrusion label may reflect only the moment an alert was generated; a transaction marked fraudulent may later be reversed.

Three problems are particularly important. Label noise occurs when an assigned outcome is incorrect. Selection bias occurs when the training data represents only the cases that reached a particular tool or team. Delayed labels arise when the true outcome becomes known weeks or months after the event. These issues can make a model appear accurate while limiting its usefulness in live operations.

Features for Threat Detection

Features should express observable evidence without incorporating information that would only be available after the decision. Malware features can include imported functions, byte sequences, permission requests, API-call sequences, file entropy, and behavioural events. Phishing features may include sender authentication results, URL structure, domain age, lexical patterns, attachment type, and message provenance. Intrusion features can include connection duration, packet or byte counts, service, protocol, failed authentications, destination reputation, and temporal patterns.

A central discipline is to separate content features, contextual features, and historical features. Content describes the object itself; context describes its environment; historical features summarize previous behaviour. Historical features can be powerful, but they can also leak future information if calculated using events occurring after the prediction time.

The Supervised Learning Toolkit

Regression: Predicting Risk Rather Than Only Class

Linear regression models a numerical target as a weighted combination of features. Logistic regression, despite its name, is a classification method that estimates the probability of a class through a logistic function. For a binary outcome, it can be written as:

\[P(y=1|x)=\frac{1}{1+e^{-(\beta_0+\beta^Tx)}}.\]

Its coefficients offer a useful baseline and can indicate the direction and approximate influence of features. Regularisation, such as L1 or L2 penalties, helps control overfitting and can reduce the influence of irrelevant variables.

In cybersecurity, regression is useful for vulnerability prioritisation, expected loss estimation, fraud scoring, and calibrated alert confidence. A vulnerability model might estimate the probability that an asset will be exploited within a planning period using severity, exposure, exploit availability, asset criticality, and compensating controls. The result should support—not replace—security judgment. A low predicted probability does not mean that patching is unnecessary when an asset is mission-critical.

Regression models are comparatively transparent and efficient, but linear assumptions can miss complex interactions. Logistic regression also requires attention to calibration: a model that ranks cases well may still produce probabilities that do not correspond to actual frequencies.

Decision Trees: Explicit Rules from Data

A decision tree recursively divides data according to feature-based conditions. A node might ask whether an executable requests an unusual privilege, whether an email URL uses a newly registered domain, or whether a login originates from an unfamiliar location. The final leaf assigns a class or numerical estimate.

Splits are commonly selected using measures such as information gain, entropy reduction, or Gini impurity. A pure leaf contains observations largely belonging to one class. Tree depth, minimum leaf size, and pruning regulate complexity. A deep, unpruned tree may memorise peculiarities in the training set and generalise poorly.

Trees are valuable when analysts need understandable decision paths. They accommodate nonlinear relationships and interactions without requiring extensive feature transformation. For example, a suspicious login may be high risk only when an unfamiliar device and impossible travel occur together. Their weaknesses include instability—small data changes may produce different trees—and a tendency to overfit noisy or high-cardinality features.

Random Forests: Robustness Through Diverse Trees

A random forest constructs many decision trees using bootstrap samples of the data and randomly selected subsets of features. Predictions are aggregated by majority vote for classification or averaging for regression. The randomisation reduces correlation among trees, while aggregation generally improves stability and generalisation compared with a single tree.

Random forests are effective for mixed tabular security data and can model nonlinear interactions with limited feature scaling. They are often useful for malware classification, intrusion detection, and fraud scoring. Out-of-bag observations—records not used in a particular tree's bootstrap sample—can provide an internal estimate of performance, though a time-aware external test remains essential.

Feature importance requires careful interpretation. Impurity-based importance can favour variables with many possible split points and may distribute importance misleadingly among correlated features. Permutation importance and explainability methods can provide additional insight, but neither proves causality. Random forests may also be computationally heavier than a single tree and less convenient when very low-latency decisions are required.

Support Vector Machines: Separating Classes with a Margin

A support vector machine (SVM) seeks a decision boundary that separates classes while maximising the margin between the boundary and the nearest training points. These nearest points are the support vectors. A soft-margin formulation permits some errors and uses a parameter commonly called C to balance margin width against training violations.

With kernel functions, SVMs can represent nonlinear boundaries. The radial basis function kernel, for example, measures similarity based on distance in feature space. This can be useful when malicious and benign observations are not linearly separable. SVMs have performed well in text classification, including spam and phishing detection, particularly when messages are represented using high-dimensional sparse features such as word or character n-grams.

Feature scaling is important because distance and margin calculations are sensitive to feature magnitude. SVMs can be difficult to scale to extremely large datasets, and their raw outputs are not automatically calibrated probabilities. Probability calibration and threshold selection should therefore be evaluated separately. In adversarial settings, small changes to inputs may alter the boundary, making robustness testing necessary.

Boosting: Correcting Errors Sequentially

Boosting builds a strong predictor from a sequence of weak learners. Each new learner concentrates on observations poorly handled by earlier learners. In gradient boosting, the next learner approximates the gradient of a chosen loss function. Popular implementations use shallow trees, regularisation, shrinkage, and subsampling to control complexity.

Boosting is powerful for structured security data. It can rank vulnerabilities, detect suspicious transactions, classify network flows, and identify phishing messages. Its strength comes from modelling subtle nonlinear relationships and interactions. For example, the combination of a new domain, a login form, unusual URL tokens, and a mismatched sender may be more informative than any single feature.

The same flexibility creates risk. Excessive boosting rounds or deep trees can overfit. Leakage, unstable labels, and distribution shift can produce impressive validation scores that fail in production. Hyperparameters must be chosen using validation data that respects time and organizational boundaries. Explainability tools such as feature attribution can support investigation, but explanations should be treated as evidence about model behaviour rather than definitive causal accounts.

Ensembles, Metrics, and Operational Decisions

An ensemble combines multiple models or views of the data. Voting combines class decisions; soft voting combines probabilities. Bagging reduces variance by training models on resampled data, as in random forests. Boosting builds models sequentially to reduce error. Stacking trains a meta-model to combine predictions from base learners. Ensembles may improve accuracy and robustness, but they increase maintenance, computational cost, and interpretive complexity. They should be justified by measurable operational benefit rather than adopted automatically.

Accuracy is often misleading in security. If only one in a thousand events is malicious, a classifier that always predicts benign achieves 99.9 percent accuracy while detecting nothing. The confusion matrix distinguishes true positives, false positives, true negatives, and false negatives. Precision is the proportion of predicted positives that are correct; recall, or true-positive rate, is the proportion of actual positives detected. The F1 score is their harmonic mean. Specificity measures the true-negative rate.

Receiver operating characteristic curves compare true-positive and false-positive rates across thresholds. Precision–recall curves are often more informative under severe class imbalance. For ranking systems, precision at the top k alerts, recall at an analyst capacity limit, and area under the precision–recall curve may be more meaningful than a single threshold metric. Cost-sensitive evaluation assigns different consequences to different errors. In a critical industrial environment, missing a destructive intrusion may be unacceptable; in an employee email system, excessive false positives may cause users to ignore warnings.

Evaluation must also measure latency, analyst workload, alert duplication, calibration, resilience to drift, and performance across subgroups or business units. A statistically superior model may be operationally inferior if it generates twice as many alerts or cannot be explained during an incident.

A Practical Workflow for Building Detection Models

A defensible workflow begins by specifying the decision: quarantine, block, investigate, patch, step up authentication, or merely enrich an alert. The team then defines the prediction time, observation window, outcome window, and unit of analysis. For example, a fraud model may use the first 30 seconds of a transaction and predict chargeback within 60 days.

Data is collected, normalised, deduplicated, and examined for missingness and sampling bias. Feature engineering should be reproducible and should preserve the point-in-time boundary. Training, validation, and test data should be separated before extensive tuning. Random splitting is unsafe when related events, users, malware families, or campaigns appear in both sets. Time-based splits better approximate deployment, while group-based splits can test generalisation to unseen organizations, devices, or malware families.

Imbalanced data can be addressed through class weighting, threshold adjustment, carefully applied resampling, anomaly-aware sampling, or collection of more representative examples. Resampling must occur inside the training folds; otherwise information can leak into validation data. The model is then calibrated, stress-tested, compared with simple baselines, and evaluated at operational thresholds.

Deployment should include versioned data and models, access controls, logging, rollback procedures, monitoring, and a feedback path from analyst decisions. Monitoring should track feature distributions, label delay, alert volume, precision, recall, calibration, and performance by relevant segments. Retraining should be triggered by evidence rather than by an arbitrary schedule alone.

Applications Across Cybersecurity

Malware Classification

Static analysis uses file properties without executing the sample; dynamic analysis observes runtime behaviour in a sandbox or controlled environment. A random forest may combine imported libraries, section entropy, permission requests, and API-call statistics. A boosting model may incorporate relationships among process creation, registry modification, network connections, and persistence attempts. Models can classify families or support a malicious-versus-benign decision.

The main challenge is family drift and adversarial modification. Packers, obfuscation, polymorphism, and environment-aware malware can alter observable features. Duplicated samples or near-identical variants across training and test sets can produce inflated performance. Evaluation should therefore test temporal and family-level generalisation, not merely random sample accuracy.

Phishing and Spam Detection

Text and URL features can be combined with sender authentication, domain reputation, attachment metadata, and user-report history. SVMs are effective for sparse n-gram representations, while boosted trees can combine text-derived scores with structured metadata. A decision threshold may route uncertain messages to review rather than block them.

The system must avoid learning unsafe shortcuts, such as treating all messages from a particular legitimate business domain as benign. It should also distinguish a malicious message from a merely unwanted one, since the response and policy may differ.

Fraud Detection

Fraud detection is a supervised security problem with severe class imbalance, delayed and disputed labels, and changing attacker behaviour. Features may include transaction amount, velocity, device consistency, account age, merchant context, and geographic patterns. The model can produce a risk score used for approval, step-up authentication, or manual review.

Temporal validation is essential because a model trained on past fraud patterns must be tested on future behaviour. Feedback loops arise when blocked transactions never generate confirmed outcomes. Consequently, evaluation should account for selective labels and should combine model outputs with controlled investigation or sampling processes.

Vulnerability Prioritisation

A vulnerability-prioritisation model can estimate exploit likelihood or expected organizational harm. Relevant features include technical severity, internet exposure, exploit code availability, asset criticality, compensating controls, and observed attack activity. Regression and ranking models are particularly suitable because the operational question is often which vulnerabilities should be addressed first, not simply whether each is dangerous.

The model should not obscure accountability. Patch decisions must consider safety, availability, contractual obligations, and the possibility that a low-frequency but catastrophic vulnerability deserves immediate action.

Intrusion Detection

Network and host telemetry can be converted into flow, authentication, process, and temporal features. Classification models identify known attack patterns, while ensembles can combine signatures, behavioural indicators, and contextual risk. A useful architecture often treats supervised learning as one layer of a broader detection system rather than as a replacement for rules, threat intelligence, and analyst reasoning.

Encrypted traffic, evolving protocols, lateral movement, and benign administrative activity complicate classification. Models must be evaluated across sites and time periods, with particular attention to alert fatigue and the cost of investigating false positives.

Illustrative Case Study: Prioritising Suspicious Authentication Events

Background

Consider Northbridge Services, a fictional organization with a cloud identity platform, remote workforce, and security operations centre. The organization receives thousands of authentication alerts each day. Analysts have confirmed a historical set of account-takeover incidents, but most alerts are benign travel, new devices, or automated service activity.

Situation and Problem

A rules-only system flags impossible travel, unfamiliar devices, and repeated failures. It produces many alerts but does not adequately distinguish routine exceptions from coordinated account takeover. The security manager wants a model that ranks alerts for investigation while preserving a high recall for serious incidents.

Analysis

The team defines one authentication event as the unit of analysis. Features are calculated using only information available at decision time: device familiarity, geographic consistency, authentication method, failure velocity, privilege level, time-of-day deviation, previous session behaviour, and whether the source network is associated with known infrastructure. Confirmed compromise within the next 14 days is the outcome label. Events from the same incident are grouped to prevent leakage, and the most recent month is reserved as a temporal test set.

A logistic regression baseline, random forest, and gradient-boosted tree model are compared. Accuracy is rejected as the primary measure because confirmed compromises are rare. The team uses recall at the daily analyst-capacity limit, precision among the top-ranked alerts, calibration, and subgroup performance across departments.

Approach and Solution

The boosted model produces the best ranking, but the random forest is easier for analysts to inspect. Rather than choosing solely by a metric, Northbridge adopts the boosted score with explanation features, a conservative threshold for privileged accounts, and a separate review band for uncertain cases. Rules remain in place for known high-confidence indicators. Analysts record dispositions, while a sampling process examines a portion of low-scoring events to estimate missed compromises and reduce selective-label bias.

Outcome

In a controlled pilot, the model allows analysts to review the most concerning alerts earlier without automatically blocking ordinary users. Monitoring shows a rise in alerts associated with a newly adopted authentication method, prompting feature review rather than assuming an attack wave. The organization establishes a rollback procedure and requires human approval for disruptive actions.

Learning Points

The case illustrates that the learning problem must be defined around a decision and time horizon. Ranking metrics may be more relevant than generic accuracy. Temporal and incident-grouped validation protect against leakage. A model is most effective when combined with rules, human review, feedback, and governance rather than treated as an autonomous authority.

Limitations, Risks, and Common Mistakes

A frequent mistake is treating a random train-test split as proof of readiness. Duplicated malware, repeated campaigns, and user-specific patterns can make the test set unrealistically easy. Another is optimizing a single metric without considering analyst capacity or the consequences of errors.

Data leakage occurs when future information, post-incident labels, remediation actions, or features generated by a downstream investigation enter training data. Class imbalance can hide poor minority-class performance. Correlated features can distort importance estimates. Concept drift may result from new malware, changed business processes, or attacker adaptation. Adversarial examples and poisoning attacks can manipulate inputs or training data.

Models can also create automation bias: analysts may accept a confident score without examining evidence. A model trained on historical analyst decisions may reproduce inconsistent practices or organizational inequities. Sensitive attributes and proxies require careful governance, particularly where predictions affect employees, customers, access, or financial services.

Governance, Ethics, and Professional Practice

Security models should have an accountable owner, documented purpose, data lineage, version history, validation results, operating thresholds, and defined escalation procedures. Access to training data must follow least privilege, retention, privacy, and contractual requirements. Personal data should be minimised and protected; where appropriate, identifiers should be pseudonymised while preserving analytical utility.

High-impact actions—blocking a customer, terminating an account, or isolating critical infrastructure—should normally include human review, appeal or correction mechanisms, and an auditable rationale. Organizations should test performance across relevant environments and populations, document uncertainty, and disclose limitations to decision-makers. Regulatory obligations differ by jurisdiction and sector, so legal and compliance review must accompany technical design.

Emerging Directions and Best Practices

Current development is moving toward multimodal detection that combines text, endpoint, identity, network, and threat-intelligence signals; continual and active learning that uses analyst feedback; graph-based representations of entities and relationships; and privacy-preserving collaboration across organizations. These approaches may improve coverage but introduce additional complexity, data-sharing risks, and validation challenges.

Effective practice can be summarised as follows:

• Define the operational decision, prediction time, and cost of errors before choosing an algorithm.
• Establish simple, interpretable baselines before adopting complex ensembles.
• Use time-aware, group-aware, and leakage-resistant validation.
• Measure precision, recall, ranking quality, calibration, workload, latency, and segment performance.
• Treat labels as evidence with uncertainty, not unquestionable truth.
• Combine machine learning with rules, intelligence, controls, and expert investigation.
• Monitor drift, feedback loops, data quality, and adversarial behaviour after deployment.
• Version models and features, document assumptions, and maintain rollback capability.
• Reserve human authority for consequential actions and continually audit outcomes.

Chapter Summary

Supervised learning converts labelled cybersecurity observations into classification, regression, or ranking models. Logistic regression provides a transparent probabilistic baseline; decision trees express nonlinear rules; random forests improve stability through bagging; SVMs separate classes using maximum-margin boundaries; and boosting constructs powerful predictors by correcting prior errors. Ensembles can improve performance but require additional governance and explanation.

Threat-detection success depends on more than algorithm choice. Feature design must respect the prediction-time boundary, labels must be examined for bias and delay, and evaluation must address imbalance, temporal change, leakage, calibration, and operational costs. Applications include malware and phishing classification, fraud scoring, spam filtering, vulnerability prioritisation, and intrusion detection. Responsible deployment combines technical monitoring with human oversight, privacy protection, accountability, and adversarial resilience.

Key Terms

Supervised learning: Learning a predictive relationship from examples containing features and known labels.

Classification: Predicting a categorical class such as malicious or benign.

Regression: Predicting a continuous numerical value such as risk or expected loss.

Ranking: Ordering cases according to priority or predicted relevance.

Feature: An observed variable used by a model to make a prediction.

Label: The target outcome assigned to a training example.

Data leakage: Use of information during training that would not be available at prediction time.

Concept drift: Change over time in the relationship between features and outcomes.

Decision tree: A recursive sequence of feature-based tests ending in predictive leaves.

Random forest: An ensemble of randomized, bootstrap-trained decision trees.

Support vector machine: A model that seeks a separating boundary with a large margin.

Boosting: Sequential construction of weak learners that progressively correct errors.

Ensemble: A system that combines predictions from multiple models or representations.

Precision: The proportion of predicted positives that are truly positive.

Recall: The proportion of actual positives detected by the model.

Calibration: Agreement between predicted probabilities and observed outcome frequencies.

Class imbalance: A condition in which one target class is much rarer than another.

False positive: A benign case incorrectly predicted as malicious or positive.

False negative: A malicious or positive case incorrectly predicted as benign or negative.

Concept drift: Change in data patterns or feature-outcome relationships that reduces model validity over time.

Review Questions

Short Answer Questions

1. Why can accuracy be misleading when detecting rare intrusions?

2. Distinguish classification from regression in a vulnerability-management context.

3. What is the purpose of the margin in a support vector machine?

4. Explain how randomisation and aggregation improve a random forest.

5. What is data leakage, and why is it especially dangerous in threat-detection evaluation?

Long Answer Questions

1. Compare decision trees, random forests, SVMs, and boosting for phishing detection, including interpretability, feature requirements, and operational limitations.

2. Explain a complete workflow for developing a malware-classification model from problem definition through deployment monitoring.

3. Discuss how class imbalance, delayed labels, and concept drift affect fraud-detection models.

4. Explain why time-based and group-based validation may be preferable to a random split in cybersecurity datasets.

5. Evaluate the role of ensembles in intrusion detection and discuss the trade-offs they create for governance and explainability.

Analytical / Application Questions

1. An intrusion detector has 99.8 percent accuracy but detects only 10 percent of confirmed attacks. Diagnose the evaluation problem and propose more appropriate measures.

2. Design a vulnerability-prioritisation model for a hospital network. Specify the target, at least six features, validation strategy, and consequences of false positives and false negatives.

3. A phishing model performs well in laboratory testing but deteriorates after a new email campaign and authentication policy are introduced. Analyse possible causes and recommend a monitoring and response plan.

22. Multiple Choice Questions with Answers

Question 1

Which evaluation approach best tests whether a malware classifier can generalize to future malware variants?

A. Randomly split near-duplicate samples into training and test sets

B. Use a time-based split and, where possible, hold out malware families

C. Measure accuracy only on the most common benign files

D. Evaluate only the training set after increasing tree depth

Correct Answer: B. Use a time-based split and, where possible, hold out malware families

Question 2

A fraud dataset contains 0.1 percent confirmed fraud. Which measure is generally more informative than accuracy for assessing detection quality?

A. Precision-recall performance

B. Number of training features alone

C. Training-set accuracy only

D. Tree depth without a test set

Correct Answer: A. Precision-recall performance

Question 3

What is the principal advantage of a random forest over a single unpruned decision tree?

A. It guarantees that every prediction is causally explainable

B. It removes the need for labelled data

C. It reduces instability by aggregating diverse trees

D. It always produces calibrated probabilities

Correct Answer: C. It reduces instability by aggregating diverse trees

Question 4

Which situation is an example of data leakage in an authentication-risk model?

A. Using device familiarity calculated from prior sessions

B. Using authentication method available at login time

C. Using an investigation outcome recorded after the login event

D. Using the user's historical login hour

Correct Answer: C. Using an investigation outcome recorded after the login event

Question 5

Why are support vector machines often useful for spam classification?

A. They require no feature scaling or validation

B. They can work effectively with high-dimensional sparse text features

C. They automatically identify all future spam campaigns

D. They only model continuous numerical targets

Correct Answer: B. They can work effectively with high-dimensional sparse text features

Question 6

In vulnerability prioritisation, why may a ranking model be preferable to a binary classifier?

A. The organization usually needs an ordered remediation queue

B. Ranking eliminates uncertainty in vulnerability labels

C. Ranking guarantees that no vulnerability will be missed

D. A ranking model never requires threshold selection

Correct Answer: A. The organization usually needs an ordered remediation queue

Question 7

What does boosting primarily do when adding a new weak learner?

A. It ignores observations already classified correctly in every case

B. It focuses learning on errors or residuals from earlier learners

C. It randomly removes all minority-class observations

D. It converts regression into unsupervised clustering

Correct Answer: B. It focuses learning on errors or residuals from earlier learners

Question 8

An organization wants to quarantine messages at a very low predicted phishing probability. What is the most important immediate concern?

A. The possibility of excessive false positives and user disruption

B. The inability to calculate any features

C. The guaranteed disappearance of concept drift

D. The elimination of the need for analyst review

Correct Answer: A. The possibility of excessive false positives and user disruption

Question 9

Which practice best addresses selective-label bias in fraud detection?

A. Train only on transactions that were blocked

B. Sample some low-risk cases for investigation and outcome confirmation

C. Discard all delayed outcomes

D. Use the same labels indefinitely without monitoring

Correct Answer: B. Sample some low-risk cases for investigation and outcome confirmation

Question 10

Why should a high-performing threat model not automatically control disruptive actions?

A. Supervised models cannot produce numerical outputs

B. Human oversight, uncertainty, privacy, and error consequences require governance

C. Decision trees are always more accurate than ensembles

D. Operational monitoring makes models unnecessary

Correct Answer: B. Human oversight, uncertainty, privacy, and error consequences require governance