A generalised linear model is a statistical model that extends linear regression to outcomes with non-normal distributions. It uses a linear predictor, a link function and an error distribution suited to the data, such as logistic regression for binary outcomes or Poisson regression for counts.
What a generalised linear model is built to do
A generalised linear model extends ordinary linear regression so the response variable can follow a distribution that better matches the data, rather than assuming normality. The model still uses a linear predictor, but it connects that predictor to the mean of the outcome through a link function, which is what makes it useful for binary, count and other non-Gaussian data.
That flexibility is the reason GLMs are a standard tool in statistics, data science and applied research. Logistic regression and Poisson regression are both special cases of the same framework, so the term describes a family of models rather than a single equation.
The three parts of the model
Every GLM has three core ingredients. First is the linear predictor, which combines input variables in the familiar weighted-sum form. Second is the link function, which maps that predictor to the scale of the outcome. Third is the error or sampling distribution, which should reflect the way the data are generated, such as Bernoulli for yes-no outcomes or Poisson for event counts.
This separation is what makes the framework more general than linear regression. The coefficients still describe relationships between predictors and the response, but their interpretation depends on the chosen link and distribution. In practice, that means analysts must think carefully about whether the outcome is bounded, skewed, discrete or otherwise non-normal before selecting the model.
Where GLMs are used
GLMs are used whenever a straight-line model would be a poor fit for the response variable. For example, a binary classification problem can be modelled with logistic regression, while counts of incidents, requests or errors are often modelled with Poisson or related count models. The framework is also common in epidemiology, economics, operations research and machine learning pipelines that need interpretable coefficients.
Because the model is grounded in probability, it is often preferred when practitioners want both statistical rigour and explainability. The outputs can support hypothesis testing, confidence intervals and effect estimation, provided the chosen distribution and link are appropriate for the data.
Assumptions, limitations and interpretation
A GLM does not remove modelling assumptions, it changes them. The predictor is still assumed to be correctly specified, the observations usually need to be independent, and the chosen distribution must reasonably match the outcome. If the distribution is wrong, the model can appear to fit while producing misleading estimates or uncertainty intervals.
Interpretation also requires care. In many GLMs, coefficients are not read directly on the outcome scale, because the link function transforms the relationship. Practitioners therefore interpret changes in odds, rates or expected counts rather than simple additive changes in the raw response.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-05 — Assets are Prioritized and Classified | GLMs are analytical assets whose correct classification affects model governance and use. |
| Recommendation — Classify statistical models by business purpose and sensitivity before approving their use in production. | ||
| ISO/IEC 27001:2022 | A.5.12 — Classification of Information | GLM inputs and outputs may include sensitive data that need classification before analysis. |
| Recommendation — Apply information classification to model inputs, outputs and training artefacts before analysis. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Model validation and use benefit from logged review of assumptions, outputs and changes. |
| CM-6 — Configuration Settings | GLM behaviour depends on configuration choices such as family, link and preprocessing settings. | |
| Recommendation — Review model changes and outputs through audit logging so anomalies and misuse can be investigated. Standardise model configuration settings so family, link and preprocessing choices are controlled. | ||
Practitioner Guidance
Common misunderstanding: A GLM is not just “linear regression with a different name.” The key decision is whether the outcome distribution and link function match the data generating process, because that choice affects coefficient meaning, residual behaviour and inferential validity.
What to watch for: If the response is binary, skewed, bounded or count-based, check whether the default linear model is forcing an unrealistic error structure. For many applications, the right question is not whether a GLM is available, but whether the chosen family and link make the results defensible.
Related resources from NHI Mgmt Group
- What breaks when organisations treat Zero Trust as a linear maturity path instead of an architectural model?
- What is the difference between a graph-based security model and a traditional linear list approach?
- What is the Model Context Protocol (MCP) and why does it matter for security?
- What does AI model abuse reveal about the current NHI threat surface?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org