A differential diagnosis is a ranked list of possible conditions that could explain a patient’s symptoms. Clinicians use it to avoid locking onto one explanation too early, especially when signs are incomplete, mixed, or misleading. In AI-assisted care, the model’s job is often to help build and prioritize that shortlist from notes, labs, and coded records.
In cyber security, the same idea appears in incident response and defensive analysis: teams compare competing explanations for an alert, such as misconfiguration, account compromise, malware, or data quality problems. This matters because attackers often hide behind ambiguity, while weak provenance, incomplete logs, or poisoned clinical data can distort the ranking. A safe system makes its evidence trail clear so humans can verify why one hypothesis came first.