What Machine Learning Threat Detection is Good At

After six years of applying machine learning to security operations problems at Netenrich, I want to share a grounded assessment of where ML genuinely improves security outcomes and where the marketing claims exceed what the technology reliably delivers.

I am going to be honest about both sides, because overselling ML capability does the industry a disservice and leads to deployments that undermine confidence in capabilities that actually work.

Where Machine Learning Threat Detection Excels

When deployed correctly, machine learning threat detection provides distinct analytical advantages over traditional correlation rules. ML is genuinely valuable in the following enterprise scenarios

1. Behavioral Profiling and Anomaly Detection

Building a statistical model of what normal activity looks like for a specific entity — a user, an endpoint, a service account, a network segment — is a problem where ML substantially outperforms rules. Normal is entity-specific. It varies by time of day, day of week, role, project phase, and dozens of factors that no rule set can capture with the specificity of a model trained on that entity's own history. When we build behavioral baselines from the entity's actual behavioral history across all data sources, we can detect deviations with a precision that rules cannot match.

2. Classification of Large-Scale Unlabeled Data

Security operations generate enormous volumes of events that no human team can review in full. ML classification can apply probability estimates to this volume — "this event pattern is consistent with credential misuse, confidence 0.87" — at a scale that makes previously impractical analysis operationally useful. The key word is probability estimate, not determination. ML outputs should be treated as prioritized candidates for human review.

3. Prioritization Under Uncertainty

Given a large alert population, ML ranking by estimated risk significance dramatically improves the efficiency with which analysts find what matters. Even imperfect prioritization — correct 70% of the time rather than random — produces substantial improvement in mean time to detect for the threats that matter most.

Acknowledging the Operational Limits and Governance of ML

While machine learning threat detection handles scale exceptionally well, organizations must implement careful governance and maintain an honest acknowledgment of its absolute limits:

Failure with Genuinely Novel Threats:

Attack techniques that have no similarity to anything in the training data — are not reliably detected by ML models. This is inherent in how supervised learning works. ML can only recognize variations of what it has learned. This is why ML does not replace threat hunting; it is why threat hunting remains essential.

Lack of Organizational Context:

Ambiguous situations requiring organizational context are not reliably handled by current ML systems. An anomaly that is highly significant in one business context and completely routine in another requires the kind of knowledge that experienced human analysts bring and that ML systems cannot currently replicate.

The Strategic Blueprint: Man and Machine Intersecting at Scale

The frame that has served us best at Netenrich: ML as force multiplier for skilled analysts, not as replacement for them. ML handles volume and pattern recognition at scale. Humans handle judgment, novelty, and context. The combination is substantially more capable than either alone.

Build for the combination deliberately. The question is not whether to use ML — you should. The question is which tasks to allocate to which layer. Getting that allocation right is where the real value lives.

*Part of my ongoing series on data science and the future of security operations.*

 
About the Author