Why a Security Risk/Fraud Score of 800 Can Mean Two Completely Different Things
When the Score Stops Meaning What It Used To
Every ML-based risk system produces a risk score for each event/transaction. Your team sets a threshold and blocks everything above it. Simple enough to explain in a meeting, consistent enough to defend to a regulator.
Here's the problem: a score of 800 during a quiet Wednesday afternoon and a score of 800 during an active account takeover attack are not the same thing. During a normal period, a score of 800 might sit at the 95th percentile of all incoming traffic when it is genuinely anomalous, legitimately high risk. Block it!
During an attack, when a fraud ring floods your system with engineered transactions, the entire score distribution shifts upward. Now a score of 800 might sit at the 60th percentile. It's not anomalous anymore but an average for the current environment. Your system is still blocking at 800. But 800...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
