What's the bias-variance tradeoff and why does it matter for security models?

High bias = model too simple, underfits (misses real attacks). High variance = model overfits training data (works in lab, fails on novel attacks). Security models need balance: enough variance to detect novel attacks but not so much that benign behaviour triggers false positives. Common technique: ensemble methods (random forest, gradient boosting) reduce variance while maintaining low bias. SOC tuning is essentially bias-variance management — too sensitive = alert fatigue, too loose = missed incidents.