Machine learning matters in cybersecurity because it can learn what normal looks like and flag deviations that no hand written rule anticipated, at a scale people cannot review. It also creates a new attack surface: models can be evaded, poisoned or made to leak data, so they need testing like any other control.
What problem does it solve?
Rules describe what you already know. NIST's guide to intrusion detection explains the limit: signature based detection compares events to patterns of known threats, and it is ineffective against variants of known threats and against attacks that spread across several events. The guide describes a different method, anomaly based detection, which compares definitions of normal activity against observed events and flags significant deviations. Profiles represent normal behavior of users, hosts, connections and applications, built by monitoring typical activity over time.
Machine learning is a way to build and update those profiles at scale, from far more signals than an analyst would pick by hand. Typical uses include spotting an unusual login pattern, clustering similar alerts, and ranking which events deserve a human first.
Where does it fall short?
The same NIST guide is candid about anomaly detection's weaknesses. A tool that works from learned profiles can raise many alerts for harmless activity, since a legitimate change in behavior looks like an anomaly, and analysts may find it hard to validate an alert because many events could have caused it. A model also learns from whatever it is shown, so if an attacker acts slowly during the training period, their behavior can become part of normal.
Can attackers target the model itself?
Yes. NIST AI 100-2 E2025 provides a taxonomy and terminology for adversarial machine learning, organized by types of ML methods, stages of the attack life cycle, and attacker goals, capabilities and knowledge. Its keywords include data poisoning, evasion, abuse and privacy breach. Evasion means crafting inputs that the model misjudges at run time. Poisoning means corrupting what the model learns from. The report is explicit that it aims to establish a common language for assessing and managing the security of AI systems.
Scale is the real argument for it. A mid-sized company can generate millions of log lines a day. No analyst reads them all, and fixed thresholds either miss quiet patterns or drown people in noise. Ranking and grouping events with a model gives humans a shorter list to judge, which is a modest but real gain, provided someone checks that the ranking is right.
A constructed example
A company deploys a model that scores logins as risky based on location, time and device. For the first weeks it flags travelers and a team that switched to a new office. The security team tunes it with an allowlist for known travel patterns and sets the response to "require extra verification", not "block". Later a red team tries logging in slowly from a new device over several days, each step looking normal. The model misses it. The result is a decision, not a failure: keep a fixed rule for impossible travel and a count of new devices per account alongside the model.
How to check or apply this
- Say what the model decides: alert, rank, or block. Start with the lowest risk option.
- Measure false positives and misses on your own data, and track them over time.
- Keep at least one fixed rule or control for the highest impact cases, so one weak model does not carry them alone.
- Log model inputs and decisions so analysts can see why an alert fired.
- Test with evasion attempts that stay below thresholds, and with variants of known attacks.
- Control what data the model trains on and who can change it.
- Use the NIST AI 100-2 vocabulary in your threat models for the ML components.
- Review model behavior after any big change in your environment.
Quick check
Does machine learning replace signature based detection?
No. Signatures are simple and precise for known threats. Learning based methods cover gaps signatures leave. Most programs use both.
What is data poisoning?
It is corrupting the data a model learns from so that it behaves wrongly later. NIST AI 100-2 E2025 lists it among the attacks on machine learning systems.
Sources
- NIST SP 800-94: Guide to Intrusion Detection and Prevention Systems (IDPS)
- NIST AI 100-2 E2025: Adversarial Machine Learning, A Taxonomy and Terminology
Last reviewed: 18 October 2026.
