Linear regression

Linear regression assumes the world is additive: each factor contributes a fixed amount, independent of the others, and the contributions simply add up. Each input gets a coefficient, the coefficients are multiplied by the input values and totalled, and the total is the prediction of a continuous number. Estimate the cost of an incident from its duration and the number of records involved, or the time to patch from the size of the estate. The whole model is one equation, and the equation is short enough to print.

It is roughly two hundred years old, which invites people to dismiss it as not really artificial intelligence. The objection is historically fair and practically useless. It is a supervised learning algorithm, every machine learning syllabus treats it as one, and it is quietly doing real work in more production systems than any neural network.

Its value in a security context is exactly its simplicity. The coefficients are the explanation. You can look at a fitted model and see that each additional day of exposure adds a specific amount to the predicted loss, then argue about whether that is plausible. You can spot immediately when a model has latched onto a variable it should never have been given. Nothing about a neural network offers that. The habit worth building is to try the simple interpretable model first and make the complicated one earn its place. A model that is two percent more accurate and impossible to explain is a poor trade when the output has to survive a regulator, a board, or a court, and a great deal of machine learning in security never needed the complexity it was given.

That readability comes with one condition. It holds while the inputs are independent of one another. Where two of them carry substantially the same information, the model has no basis for deciding which earned the credit, so the split between their coefficients is arbitrary and shifts when the model is retrained, even though the prediction does not. The equation stays short enough to print and stops being safe to read aloud. See multicollinearity.