A SOC manager wants to know when to trigger a full retraining of their ML-based threat detection model. Which operational metric most directly signals that retraining is needed?

• A.The SIEM rule set has been updated, requiring the ML model to be retrained to stay synchronized; supervised detectors generalize to novel attack families without retraining, since malicious behaviour shares a fixed statistical signature across techniques
• B.A sustained increase in the model's false negative rate (missed detections confirmed retrospectively) or a significant shift in the input feature distribution (data drift), compared to the model's deployment-time baseline
• C.The number of new CVEs published exceeds 100 in a given month
• D.The model has been running in production for more than 6 months, since all models should be retrained on a fixed calendar schedule