Confidence calibration is the alignment between a model’s stated certainty and the real accuracy of its output. A well-calibrated system should express high confidence only when it is usually correct, and low confidence when its answer is uncertain or incomplete. In cyber security, this matters because analysts and automated tools often use model confidence to decide whether to block traffic, escalate an alert, or ask for human review.
Poor calibration can be dangerous in both attack and defense. An overconfident model may label a phishing email as safe, miss malware, or generate misleading remediation advice with unjustified certainty. Defenders use calibration to improve triage, route uncertain detections to analysts, and reduce automation bias. Attackers can also benefit when generated lures or false reports sound more certain than they really are, making deception easier to trust. Good calibration supports safer human-in-the-loop decisions.