How do you prevent ML model drift in a SOC?

Drift types: (1) Covariate shift — input data distribution changes (new attack patterns, new user behaviour). (2) Concept drift — relationship between input + label changes (what was anomalous before is now normal). Detection: (1) statistical monitoring (KL divergence, Wasserstein distance) between training + production data; (2) prediction confidence drops; (3) increased analyst false positive reports. Mitigation: (1) scheduled retraining (weekly/monthly); (2) online learning with caution (adversaries can poison live training); (3) champion/challenger model deployments; (4) model registry with versioning + rollback. Critical: never auto-deploy retrained models to prod without validation set + human review.