A malware classifier outputs a probability, not a verdict. The decision threshold converts that score into “malware” or “benign”, and where you place it decides the trade-off between catching threats and raising false alarms. Drag the threshold below and watch the confusion matrix respond. Distributions mirror a balanced CIC-MalMem-2022 split (58,596 samples); the model is the ANN baseline from my MSc dissertation.