Investigate a Decrease in Webpage Warnings

# Investigate a Decrease in Webpage Warnings A system that warns users about malicious webpages shows a decrease in the number of warnings displayed. How would you investigate? Explain how you would distinguish an improvement in safety from a detection, delivery, or measurement problem, and what evidence would guide the next action. ### What a Strong Answer Covers - Validation of the warning metric, time comparison, and logging completeness. - A decomposition from browsing traffic through scoring and warning display. - Segments and release checks that distinguish prevalence changes from pipeline faults. - Independent evidence of malicious exposure and a decision appropriate to the cause. ```hint Follow a browsing encounter A malicious page can be missed because it was never scored, not flagged, not rendered, or not logged. ``` ### Follow-up Questions - What would you conclude if flags stayed constant but displayed warnings fell? - How would you estimate whether false negatives increased?