A SOC team implemented a new ML-based UEBA platform 3 months ago. The system generates 800-1,200 alerts per day. The three-person tier-1 analyst team was previously handling 80 alerts per day from their rule-based system. After 3 months, analyst morale has plummeted - 94% of investigated UEBA alerts turn out to be benign (employee working late, VPN from a new coffee shop, accessing a new file share for a project).
A SOC analyst is reviewing alerts from an ML-based UEBA (User and Entity Behavior Analytics) system. The system flagged 847 events in the past 24 hours, but the analyst's previous experience suggests most will be false positives. What is the primary challenge this illustrates with ML-based security detection?
- A.B. The false positive economics problem: high false positive rates waste analyst time, cause alert fatigue, and may lead analysts to ignore genuine alerts mixed in with the noise
- B.A. ML systems cannot detect real attacks - only baseline deviations
- C.C. UEBA systems are not capable of correlating events across multiple users
- D.D. ML-based UEBA requires more compute power than organizations can afford
Why A is correct
False positive economics is one of the primary operational challenges of ML-based security detection. High false positive rates create: analyst fatigue (cognitive exhaustion from investigating non-events), opportunity cost (time not spent on genuine threats), and desensitization (analysts learn to dismiss alerts and may miss real ones). This is a systemic tradeoff in security ML - models tuned for high recall generate many false positives; models tuned for high precision miss threats. Organizations must deliberately manage this tradeoff.
Know someone studying for AI Security Fundamentals? Send them this one.