Explain the difference between supervised, unsupervised, and reinforcement learning in security contexts.

Supervised — labelled training data (e.g. malware vs benign samples). Used for malware classification, phishing detection. Drawback: needs labelled data. Unsupervised — no labels; finds patterns/anomalies in data. Used for UEBA (user behaviour anomaly detection), unknown threat clustering. Drawback: harder to validate. Reinforcement learning — agent learns through trial-and-error rewards. Used for adaptive defence, automated red-team agents (PentestGPT-style). Drawback: requires defined reward function — easy to misalign in security.