Online learning is a machine learning method that updates a model incrementally as new data arrives, rather than retraining it only in large batches. Each new event, alert, or transaction can slightly adjust the model, so its behavior stays closer to the current environment.
In cyber security, this matters because attackers adapt quickly. Network traffic patterns, phishing content, malware behavior, and fraud signals can change faster than a static model can learn. Online learning helps defenders keep intrusion detection, spam filtering, and anomaly detection systems current as conditions drift. It is also useful when data streams are too large to store and retrain from scratch. The main risk is that a model can be influenced by noisy data or adversarial manipulation, so online systems need validation, monitoring, and safeguards against poisoning and drift.