SHAP (SHapley Additive exPlanations) is a post-hoc explanation method for machine-learning models. It estimates how much each input feature pushed a prediction up or down compared with a baseline. For example, in a phishing or fraud model, SHAP can show that a suspicious domain age, an unusual login location, or a mismatched transaction amount contributed most to the score.
In cyber security, SHAP helps analysts debug detections, validate model behavior, and communicate why an alert fired. It is useful for spotting bias, feature leakage, or rule drift in defenders’ models. But SHAP does not verify whether the data was authentic, current, or allowed to be used; it only explains the model’s math after the fact. That means SHAP should be paired with provenance checks, time-aware data controls, and policy validation before inference.