An MSSP customer complains that a new month-end upload tripped a volume alert, and the follow-up found no malware. What tradeoff should the analyst explain to the customer?
Select an answer to reveal the explanation.
Short Explanation
A new truck on the last day of the month can trip a volume sensor with legitimate cargo. You explain that behavioral detection flags departures, including a real month-end upload. The trap is claiming signatures catch every new upload, that the alert proves theft, or that statistics cannot see volume.
Full Explanation
Behavioral and statistical detection compare activity with a baseline. A new month-end upload can depart from that baseline in volume even when the file is legitimate business, which is why the review found no malware. That noise is the tradeoff of departure-based detection. "Behavioral detection flags departures from baseline, including legitimate new business" is the tradeoff to explain. "Signature detection always catches a brand-new upload the first time that upload appears" has it backward: a signature needs a known pattern and misses unfamiliar content. "The volume alert proves data theft even after the review found no malware in the upload" treats a baseline trip as proof of theft. "Statistical detection cannot see volume, so this alert cannot be a baseline departure" denies the signal statistical detection is built to notice. Exam caveat: a departure alert is a lead, and a clean malware review does not rewrite the baseline by itself. Operational check: compare the upload volume and destination with prior month-end jobs, then decide whether the baseline should learn this business pattern.