Sampling bias is distortion caused when the data you collect overrepresents some behaviors and underrepresents others. In cyber security, this matters because logs, alerts, and telemetry are often treated as if they describe the whole environment, when they may only capture what a specific tool, interface, or user group can see.
Attackers can exploit sampling bias by blending into the parts of a system that are least observed, such as low-volume activity, rare protocols, or behavior that falls outside a detection rule’s training data. Defenders see it in threat hunting, endpoint monitoring, and chatbot or SOC analytics when “normal” looks different simply because the sample is skewed. Biased samples can hide stealthy abuse, inflate false confidence, and produce models that perform well on paper but fail in real deployments. Good practice is to compare multiple data sources, review collection rules, and test whether the sample reflects the full range of expected behavior.