Skip to content

What Machine Learning Can and Can't Do for Security

Wendy Edwards

Wendy Edwards separates hype from reality in security AI, analyzing where machine learning excels in anomaly detection and where it fundamentally fails.

Summary

Demystifying Machine Learning in Cybersecurity

While security marketing frequently touts artificial intelligence and machine learning as silver-bullet solutions, understanding their mathematical capabilities and limitations is critical.

Where Machine Learning Excels in Defense

Wendy Edwards reviews successful ML applications—including high-volume spam classification, binary feature clustering for malware detection, and network baseline anomaly detection.

The Inherent Limitations and Failure Modes of Security ML

Edwards explores why ML models struggle with high false-positive rates, concept drift, adversarial evasion attacks, and lack of explainability in incident response.

A Pragmatic Evaluation Guide for Security Practitioners

The presentation provides security teams with an objective framework to evaluate ML-based security products and understand their true operational value.

Related talks

Blue Team Village·41 min

  • DEF CON
  • Blue Team
  • Date: Aug 2019
  • Location: Las Vegas

Shawn Thomas

A mostly live demo of base concepts of malware analysis using a multitude of tools on a Dridex sample pulled from a phishing campaign from PDF attachment to executable installation. The main point is to show people so...

malware-analysisblue-teamdefense+1