Accuracy Is Not Enough: Detecting Hidden Risk in CVE Impact Prediction

In high-stakes environments like healthcare, autonomy, critical infrastructure, finance, and security - false negatives carry outsized consequences. One miss can overwhelm every other metric, which is why recall, calibrated thresholds, and decision SLAs matter more than plain accuracy. By reframing the confusion matrix into levels (L0-L6), I show how to work backwards from risk exposure and design metrics that guide both model calibration and system-level SLAs. In finance and cyber, predictive models aren’t judged by elegance, but by how deterministically they can protect capital, data, and trust. The right metrics are the difference between models that look good on paper vs. systems that deliver measurable ROI.