Machine learning

Traditional software does what somebody told it to do. An engineer writes a rule, the rule runs, and when the output is wrong you can find the line that caused it. Machine learning inverts that. You supply examples, an algorithm finds the patterns separating them, and the resulting model applies those patterns to inputs nobody anticipated. Nobody wrote the rule that flagged the account. The rule was derived.

That inversion is why machine learning is everywhere in security. Spam filtering, fraud scoring, endpoint behavioural detection and every large language model are the same idea applied to different data. Hand-written rules cannot keep pace with attackers who change methods faster than anyone can write signatures, whereas a model that learns what normal looks like can flag the abnormal without being told in advance what abnormal is. The two broad approaches are supervised learning, which learns from labelled examples, and unsupervised learning, which is given no labels at all.

The cost lands on accountability. When a control is a rule, the reason it fired is the rule, and you can show it to an auditor. When a control is a model, the reason it fired is a pattern spread across thousands or billions of learned parameters, and “the model decided” is not an explanation anyone will accept for a blocked payment or a rejected candidate. This is why choosing an algorithm is a governance decision and not only a technical one. Some models can tell you why (a decision tree, a linear regression). Others cannot (a neural network of any kind, including a convolutional neural network). Whether you need the explanation should be settled before the model is chosen, not after a regulator asks.