Accuracy is the proportion of evaluated instances a classifier labels correctly. It gives a quick overall view of performance, whether the task is identifying suspicious logins, classifying cybersecurity articles, or detecting threatening network traffic. section 12.3.1 section 12.4.1
Compare models on held-out logins
On a 30-instance test set, a random forest correctly labels every login and scores 1.00; an SVM scores about 0.87. That comparison favors the random forest on this test, but the SVM’s class-level results add context: it identifies most malicious logins while misclassifying some normal ones as malicious. section 12.3.1
Do not use accuracy alone to decide whether a security model is useful. A classification report separates precision and recall by class, while a confusion matrix shows which predictions are correct and which kinds of errors occur. These details matter when missed threats and unnecessary alerts carry different operational risks. section 12.4.1 section 12.5.1
precision recall f1-score support
0 0.63 1.00 0.77 126
1 1.00 0.00 0.00 74
accuracy 0.63 200
macro avg 0.81 0.50 0.39 200
weighted avg 0.77 0.63 0.49 200
The network-traffic report makes the limitation concrete: accuracy is 0.63 across 200 test instances, yet recall for class 1 is 0.00. The overall score alone would conceal that the model detected none of the instances in that class. section 12.5.1
For a decision about deployment or improvement, report accuracy alongside class-level results and the errors that matter most to the security team. Treat automated scores as evidence to investigate, not as a replacement for security expertise. section 12.5.1 section 1.7
