Why does MAPE become unreliable with zero or near zero actuals?

MAPE divides absolute error by the actual value, so zero or near zero actuals can make the result undefined or extremely large. That makes the metric unstable for sparse datasets, ratios, and workloads with small denominators. In those cases, teams usually choose MAE, RMSE, or a related metric that does not depend on division by the actual value.

Why This Matters for Security Teams

MAPE becomes unreliable around zero because percentage error is defined against the actual value, so the metric stops behaving like a stable operational signal when denominators shrink. That matters anywhere demand is sparse, intermittent, or ratio-based, because the same absolute miss can swing from trivial to extreme depending on the baseline. In practice, this turns performance review into a denominator problem rather than a forecasting problem.

Security and operations teams see the same failure pattern in NHI and credential telemetry: low-volume events can hide meaningful risk, while a single spike can distort the picture. NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to Non-Human Identities, which is exactly the kind of environment where unstable metrics mislead more than they inform. When leaders need a defensible control view, NIST SP 800-53 Rev 5 Security and Privacy Controls is a better anchor for control evidence than a fragile percentage metric. In practice, many teams discover MAPE’s weaknesses only after a low-activity period has already produced a misleadingly clean report.

How It Works in Practice

MAPE calculates each error as a percentage of the actual value, then averages those percentages. That works reasonably well when actuals stay comfortably above zero and are broadly similar in scale. It breaks down when actuals are zero or near zero because division either becomes undefined or magnifies tiny absolute errors into oversized percentages. A forecast off by 2 units may be acceptable in one context and catastrophic in another, but MAPE makes both look wildly different based only on the denominator.

Practitioners usually address this in one of three ways. First, they switch to MAE or RMSE when the goal is to measure absolute deviation rather than percentage deviation. Second, they use sMAPE or a capped percentage variant when they still need relative error, while recognising that current guidance suggests these are compromises rather than perfect fixes. Third, they segment the data and report separate metrics for zero-heavy and non-zero periods so the metric matches the distribution.

That same logic matters in NHI operations. If credential use is sparse, a metric can appear healthy while still masking exposure. The TruffleNet BEC Attack is a reminder that credential misuse often becomes visible only after the underlying pattern has already been exploited, so teams need metrics that remain meaningful under low-volume conditions. For control design, NIST’s emphasis on measurable safeguards in NIST SP 800-53 Rev 5 supports selecting a metric that is stable, auditable, and suited to the data shape. These controls tend to break down when the dataset contains many zeros because the denominator dominates the result more than the underlying error does.

Common Variations and Edge Cases

Tighter percentage-based reporting often increases interpretability for business stakeholders, requiring organisations to balance familiarity against mathematical stability. That tradeoff is most visible when teams compare product lines, regions, or time windows with very different base rates. In those cases, a single metric rarely serves every audience well.

There is no universal standard for this yet, but current guidance suggests choosing the error metric based on the decision being made. If the question is “how far off are we in units,” use MAE or RMSE. If the question is “how large is the miss relative to a meaningful baseline,” consider WAPE or a scaled metric with explicit handling for zero actuals. If the data is intermittent, sparse, or zero-inflated, report the share of zero actuals alongside the metric so readers understand where MAPE is likely to mislead.

For governance-minded teams, the practical test is whether the metric still supports action when actuals are absent or tiny. If it does not, it is not a reliable control indicator. NHI Mgmt Group’s Ultimate Guide to Non-Human Identities is useful here because the same visibility and lifecycle gaps that weaken identity control reporting also weaken percentage-based scoring. In sparse environments, the safest choice is usually to pair a stable absolute metric with a clearly bounded relative metric rather than relying on MAPE alone.

Related resources from NHI Mgmt Group

• When does regex-based secret detection become too unreliable for production use?
• When does machine identity risk become a zero trust problem?
• When does machine identity risk become a zero trust issue?
• When does Zero Trust become more than a policy label for NHI governance?