Up-to-date security software can identify known malware, but not all threats have defined signatures; threat actors amend their tactics constantly, new malware is developed, and new domains and IP addresses are registered and used.
It is important for cybersecurity operators to understand that security software cannot 100% definitively classify activity into the binary malware/non-malware groups. This fact that sometimes software classifies activity incorrectly means that there are four different categories.
The four different categories are often thought about in terms of a table dividing the actual threat against the software classification. The following diagram shows a different interpretation of this setup:
System activity classified as True Negatives/True Positives; False Negatives and False Positives are a concern for cybersecurity operators
In an...
