2026 · 11 min read
Explainable Alert Prioritisation: An Evaluation Protocol for SHAP-Based Insider Threat Detection in Critical National Infrastructure
A protocol and two new metrics, ECR and APFS, for testing whether SHAP explanations actually help SOC analysts prioritise insider threat alerts, or just look convincing.