Generalization is a model’s ability to perform well on new data that differs from what it saw during training. In machine learning, a system that generalizes well recognizes the underlying pattern, not just the exact examples in its training set. A model that memorizes training data may look accurate in testing but fail when the input changes.
In cyber security, generalization is critical because attackers constantly alter code, packet contents, file layouts, and delivery methods. A malware detector or network classifier that only works on one lab dataset can miss repacked binaries, modified payloads, or traffic from a different environment. Defenders evaluate generalization by testing on unseen samples, new campaigns, and shifted data sources. In image-based threat detection, for example, a model may learn useful visual structure from malware images, but it must still recognize threats when the conversion method, file packing, or feature distribution changes. Strong generalization is what turns AI from a demo into a usable defense.