# Machine Learning Security Training for Government Agencies

By Curtis Lambert · 2026-08-24

> What machine learning training for a federal SOC should cover: agency telemetry, alert-budget math, offline labs, and where ML training does not help.

A detection model that is 99.9 percent accurate will bury a federal SOC. That single fact should shape every machine learning course an agency buys, and most of them ignore it.

Run the arithmetic that a vendor slide never shows:

```python
events_per_day = 20_000_000      # authentication + process + network, mid-size agency
false_positive_rate = 0.001      # 99.9% "accurate"
print(events_per_day * false_positive_rate)   # 20000.0
```

Twenty thousand false alerts a day, on top of the queue the team already cannot clear. The model is not broken. The evaluation metric was the wrong one, and nobody in the room had been trained to catch it. This is the single most common failure mode I have seen in government analytics work, and it is a training problem before it is a modeling problem.

## Train Against the Telemetry the Agency Actually Keeps

Generic ML courses run on the Iris dataset and MNIST. Security-specific courses that were built for a commercial SOC run on data an agency may not have in the same shape.

The material that transfers is built on what federal environments actually retain: Windows Security Event IDs 4624 and 4625, Sysmon Event ID 1 (process creation) and Event ID 3 (network connection), [Zeek](https://zeek.org/) `conn.log` and `dns.log`, EDR process telemetry, and the identity and asset inventory that CDM reporting already forces agencies to maintain. That last source is the one most teams underuse. Asset criticality and account type turn a generic outlier score into a triage decision.

The work in a good course is unglamorous and it is most of the job:

- **Joining across sources on time and identity.** Reconciling a Windows account name, a Kerberos principal, and an EDR host GUID is where a week disappears on a real project.
- **Encoding fields that are not numbers.** High-cardinality categoricals (source IP, process path, user agent) need target or frequency encoding, not one-hot expansion into a million columns.
- **Building features with security meaning.** Logon volume per account relative to its own 30-day baseline, time-of-day deviation, count of distinct destinations per source, and parent-child process rarity. Features carry the detection. The algorithm choice matters less than practitioners expect.

Anomalous-account behavior is [T1078](https://attack.mitre.org/techniques/T1078/), Valid Accounts, and framing labs against ATT&CK technique IDs rather than "suspicious activity" is what makes the output legible to the rest of the agency.

## Evaluation Is the Block That Earns the Budget

If a syllabus spends one hour on evaluation and two days on algorithms, it is an ML course with security data pasted on.

At a base rate of one malicious event in a million, accuracy is meaningless and ROC AUC is close to it, because the false positive axis is dominated by the negative class. The metrics that decide whether a detection ships are precision at a fixed alert budget and the precision-recall curve:

```python
from sklearn.metrics import average_precision_score, precision_recall_curve

precision, recall, thresholds = precision_recall_curve(y_true, scores)
# Pick the threshold by what the shift can review, not by what maximizes F1.
budget = 50                                    # alerts an analyst can work per shift
cutoff = sorted(scores, reverse=True)[budget]
print(average_precision_score(y_true, scores))
```

In our labs students set that cutoff before they compare a single model, because the budget is the fixed constraint and the model is the variable. Choosing the threshold from analyst capacity rather than from an F1 optimum is a one-line change and a different way of thinking about detection engineering. Agencies that adopt it stop shipping models that technically work and operationally fail.

The second half of evaluation is adversarial. A deployed classifier is a target, and the vocabulary for that is standardized: [NIST AI 100-2](https://csrc.nist.gov/pubs/ai/100/2/e2025/final) for the adversarial ML taxonomy, [MITRE ATLAS](https://atlas.mitre.org/) for the technique IDs. Model evasion is [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015). Any course teaching agency staff to build detections should also teach them how those detections get bypassed. Governance frameworks belong here too, though briefly: [NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework) gives an agency the Measure vocabulary for documenting all of this, and it is a half-day topic, not a course.

## Delivery Constraints Decide Whether Training Happens at All

Curriculum is the easy part. Federal training dies in logistics.

Government-furnished laptops usually block local admin, virtualization, or both. Mission networks do not reach `pypi.org` or a hosted model API. Cleared staff frequently cannot attend a public course at a commercial venue. Any of those turns a well-designed syllabus into a room of people watching an instructor type.

The workable answer is a lab that assumes nothing from the network: a guest image carrying its own Python, libraries, datasets, and model weights. GTK Cyber has run a full course this way inside a military cyber unit with no traffic leaving the environment. The staging work is the part to plan for, because every package and weight file has to be assembled before the image crosses the boundary, and there is no fixing an omission from inside.

Two questions worth asking any training vendor before scoping an agency delivery: can your labs run with the network cable pulled, and have they? The answers separate vendors quickly.

## Where This Training Does Not Help

Machine learning training does not fix a data problem. If the agency's telemetry is scattered across systems with 30-day retention and no common identity field, students will spend a course learning techniques they cannot apply when they get back. Fix the pipeline first. A data engineering effort is less exciting than an ML course and it is the prerequisite.

It also does not produce an authority to operate, a compliance artifact, or a staffed detection engineering team. It produces people who can build, evaluate, and defend a model. Converting that into a deployed capability is a separate program with its own timeline.

And if the team's Python is shaky, sequence the training. Analysts fighting syntax do not learn feature engineering.

The defensive side is only half the picture for agencies now standing up their own AI systems. The adversarial half, including how AI red teaming is scoped and bought, is covered in [AI red team training for federal security contractors](/blog/ai-red-team-training-federal-contractors). GTK Cyber's [Applied Data Science and AI for Cybersecurity](/courses/applied-data-science-ai) course covers the material above as a closed-cohort engagement, on site or virtual, with the offline lab environment described here. Delivery options and registration data for agencies are on the [federal training page](/lp/ai-training-federal-agencies).

## FAQ

### What should machine learning training for a government security team cover?

Four blocks, in this order. Data engineering against the telemetry the agency actually retains (Windows Security 4624 and 4625, Sysmon Event ID 1 and 3, Zeek conn.log, EDR process events, identity and asset inventory). Supervised classification for problems with labels, such as phishing URLs and known malware families. Unsupervised anomaly detection for hunting, where labels do not exist. And evaluation under extreme class imbalance, which is where most agency ML projects quietly fail. Framework literacy (NIST AI RMF, NIST AI 100-2) belongs in the course, but it is the shortest block, not the longest.

### Can machine learning training be delivered on an air-gapped government network?

Yes, and for mission networks it usually has to be. The requirement is a lab that carries its own Python distribution, libraries, datasets, and model weights so no exercise reaches out to a package index or a hosted API. GTK Cyber has delivered a full course end to end inside a military cyber unit with no external network. The logistics detail people miss is staging: every wheel and every model file has to be pulled and packaged before the image crosses the boundary.

### Do agency analysts need a data science background before ML security training?

They need working Python, not a data science background. An analyst who can read a script, write a loop, and manipulate a DataFrame can absorb a four-day applied course. An analyst who is still learning syntax will spend the labs fighting the language instead of the problem, and the seat is wasted. If a team is not there yet, run a Python course first and the ML course a quarter later. That sequencing costs less than repeating the ML course.

### Will machine learning training reduce our alert volume?

Not by itself, and be skeptical of anyone who says otherwise. A classifier at a 0.1% false positive rate against 20 million daily events produces 20,000 false alerts per day, which is worse than what most agency SOCs run today. Training changes the outcome only if it teaches ranking and precision at a fixed alert budget rather than headline accuracy. That is a specific curriculum choice, and you should ask about it before you buy.

### How do federal agencies procure this kind of training?

Most deliveries are closed-cohort engagements priced per student per day, scheduled on site at an agency facility or delivered virtually for unclassified work. GTK Cyber, LLC is a registered small business (UEI FL7WRSQMR4S8, CAGE 8CWY8, DUNS 080786769) and is eligible for small business set-asides as well as full and open competition. Registration data, NAICS codes, and past performance are on the government page for anyone assembling a sources sought response or a market research package.


---

Canonical: https://gtkcyber.com/blog/machine-learning-security-training-government-agencies/