[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.5.b
AP Cybersecurity · Securing Networks
Leveraging AI for Threat Detection
The model outputs a probability. The organization chooses the threshold — and that choice is the policy.
key ideaThe model outputs a probability. The organization chooses the threshold — and that choice is the policy.
The idea
Why AI at all
Computers log every action users take, and firewalls, IDS, IPS and other sensors log all the traffic passing through the network. A medium-sized organization logs millions or tens of millions of events a day — a volume no team can read.
What the model produces
Threat-detection teams create AI algorithms to analyze that data and classify patterns as malicious or normal. The models are probabilistic: the output is a percentage likelihood that something is malicious, not a verdict.
The modelreports a likelihood
The organizationsets the threshold
Either extremeends in missed attacks
Probabilistic outputA percentage indicating how likely it is that an event is malicious — not a yes or no.
ThresholdThe likelihood at which an alert is raised. Each organization determines its own.
False negativeA real attack that did not alert — what a threshold set too high produces.
False positiveAn alert with no attack behind it — what a threshold set too low produces in volume.
Alert fatigueThe state in which analysts stop trusting a queue that is usually wrong. It is how a low threshold turns into missed attacks anyway.
| Threshold | False positives | False negatives | Practical outcome |
|---|
95% — very high | few | many | a quiet queue that misses real attacks |
80% — high | low | some | manageable; may miss novel techniques |
50% — moderate | moderate | fewer | needs enough analysts to keep up |
20% — low | many | few | the team is overwhelmed and stops reading |
The bottom row is the trap that looks safest. A threshold so low that nobody reads the queue detects nothing in practice — the misses simply happen at the human stage instead of the model's.
Why it works that way
A detector that never errs would be a classifier with perfect information, which is not available. Given imperfect information, every setting trades one kind of error for the other — so the honest question is which error your organization can better afford.
the four claims
- Volume is the premise: millions to tens of millions of events a day at a medium-sized organization.
- Models classify patterns as malicious or normal and report a likelihood, not a verdict.
- The organization sets the threshold at which a likelihood becomes an alert.
- Too high misses real attacks; too low overwhelms the team — and both end in missed attacks.
Worked analysis
EX 1
Choose a threshold
A team of four analysts can investigate about 40 alerts a day. The model currently produces 600 above the configured threshold. What do you change?
1
Compare capacity with volume
600 against 40 — 15 times the team's capacity.
2
Name the failure mode
Alerts go unread, so the effective detection rate is far below what the numbers suggest.
3
Raise the threshold
Set it so the daily volume lands near 40.
4
Acknowledge the cost
More false negatives — some real attacks will not alert.
5
Compensate
Tune the rules to reduce false positives at the same confidence, rather than only moving the dial.
EX 2
Why a low threshold can be worse
A manager proposes setting the threshold at 10% so that “nothing gets missed”. Evaluate.
1
Grant the intent
On paper, a low threshold minimizes false negatives.
2
Follow it into practice
The queue fills with events that are almost all benign.
3
Predict the human response
Analysts stop reading it — alert fatigue is a reliable consequence, not a possibility.
4
State the outcome
Real detections are buried, so attacks are missed anyway.
5
Give the correct framing
The effective threshold is wherever the team stops reading. Set it deliberately rather than discovering it.
EX 3
Reading a probabilistic output
A model reports 68% likelihood that a connection is malicious. What does that mean, and what should happen?
1
Read it correctly
A probabilistic estimate — not a claim that the connection is malicious.
2
Compare with the threshold
If the organization alerts at 60%, this alerts; at 80%, it does not.
3
Note what the number is not
It is not a claim that 68% of such connections are attacks in general — it is this model's confidence about this event.
4
Decide the response
Alert for human review; a figure in this range rarely justifies automatic blocking.
5
Note the feedback loop
Record the analyst’s verdict so the model and the threshold can both be tuned against reality.
Common traps
A likelihood is not a verdict
AI threat models are probabilistic and report a percentage. Treating 72% as ‘malicious’ discards exactly the information the model was built to provide.
There is no threshold with no errors
Every setting trades false negatives against false positives. The organization chooses which error it can better afford.
A low threshold is not the cautious choice
Overwhelming the security team produces missed attacks just as reliably as a high threshold does — the miss simply happens later in the chain.
Thresholds are not set once
Traffic patterns, staffing and the model itself all change. Review the alert volume against team capacity on a schedule.
Check yourself
Why can humans not analyze network logs directly?
Show answer
A medium-sized organization's network logs millions or even tens of millions of events daily — every user action, plus all traffic through firewalls, IDS, IPS and other sensors.
What kind of output do AI threat-detection models produce?
Show answer
A probabilistic one — a percentage indicating the likelihood that something is malicious, rather than a definite classification.
Who decides when a likelihood becomes an alert?
Show answer
The organization determines its own threshold for what percentage of likelihood results in an alert.
Give the consequence of setting the threshold too high, and too low.
Show answer
Too high: real attacks may go undetected. Too low: the security team is overwhelmed — and an unread queue misses attacks too.