Högskolan i Skövde

False Positives (FPs) and False Negatives (FNs) remain common challenges in AI-based anomaly detection systems (ADS) used to identify cybersecurity threats. These issues continue to affect both detection accuracy and the analysts’ trust in the systems. While most research focuses on improving anomaly detection models, this study examined how cybersecurity professionals handle FPs and FNs in practice. Based on 31 written interviews with cybersecurity professionals, this study explored how these tools are used in reality situations. The analysis showed that AI-based anomaly detection systems can be helpful to search unusual activity but these systems are not fully trusted without human involvement. Participants mentioned challenges such as false alerts, unclear decision making, and the need to adjust the systems and collaborate with other teams. The findings suggest that the effectiveness of AI-based anomaly detection systems depends on factors that they are trust, clear communication and a good connection between the system’s output and what teams need in practice.