Underfitting is a machine learning problem where a model is too simple to capture the patterns in the training data. It usually shows up when the model performs poorly on both training and unseen data because it misses real structure rather than learning it too closely.
What underfitting means in practice
Underfitting is not just “a bad model”, it is a model that is too constrained to learn the underlying structure in the data. In practice, that often means the model is oversimplified relative to the problem, the feature set is insufficient, or the learning process is stopping before the model has extracted the useful signal.
The key diagnostic is that performance is poor on both the training set and any held-out evaluation data. That distinguishes underfitting from overfitting, where the model memorises training data but fails to generalise.
Common causes of underfitting
Underfitting usually comes from a mismatch between model capacity and task complexity. A linear model may be too weak for a highly non-linear relationship, but the same result can also come from excessive regularisation, weak feature engineering, too few training iterations, or overly aggressive simplification during model design.
It can also appear when the data representation itself is thin. If the model never sees informative features, or if important patterns are collapsed during preprocessing, even a theoretically capable model may still behave as if it were too simple.
Why underfitting matters
Underfitting wastes modelling effort because it leaves predictive value on the table. In production settings, that can mean missed detections, inaccurate forecasts, poor ranking quality, or brittle automation that appears stable but has low usefulness because it has not learned enough structure to be reliable.
It also creates a false sense of certainty. A model that is consistently wrong in a simple way may look clean from an engineering perspective, but the operational consequence is that it fails to capture the distinctions the business actually depends on.
How practitioners recognise and correct it
The usual signal is a high training error that remains high after reasonable tuning. Practitioners often confirm the pattern by comparing learning curves, checking whether more training improves results, and testing whether the model family is expressive enough for the task.
Correction typically means increasing model capacity, improving features, reducing unnecessary regularisation, giving the model more opportunity to learn, or choosing a more suitable algorithm. The right fix depends on whether the limitation is in model design, optimisation, or data representation.
Risk and Threat Considerations
Underfitting becomes a security and operational risk when it is used in decisions that depend on separating normal from abnormal behaviour, low risk from high risk, or legitimate from suspicious activity. In those settings, the failure is not subtle, it can systematically miss the patterns the control is meant to detect.
Failure mechanism: A model with insufficient capacity or poor feature representation learns an overgeneralised rule and cannot distinguish important edge cases, so false negatives rise in the exact situations where nuance matters most.
Impact: Missed detections, weak prioritisation, and unreliable automation can follow, especially in monitoring, classification, fraud scoring, or other decision pipelines where the model is part of a control path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS and NIST AI RMF set the technical controls, while ISO/IEC 42001:2023 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Underfitting can stem from incomplete data and feature inventory, which maps to knowing what inputs exist. |
| Recommendation — Inventory the data sources and model inputs before validating whether the model can learn the needed patterns. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Underfitting weakens anomaly and misuse detection by failing to distinguish meaningful patterns. |
| Recommendation — Tune detection models so monitoring logic can separate normal from suspicious behaviour with enough fidelity. | ||
| OWASP ASVS | V2 — Validation and Business Logic | Underfitting matters when model outputs drive application decisions and must reflect real business distinctions. |
| Recommendation — Validate that decision logic and learned behaviour preserve the distinctions the application relies on. | ||
| NIST AI RMF | GOVERN — Govern, Map, Measure, and Manage AI risks | Underfitting is an AI risk-management concern because model limitations affect performance and trustworthiness. |
| Recommendation — Measure model performance against the intended use case and manage known limitations before deployment. | ||
| ISO/IEC 42001:2023 | 8.3 — AI risk treatment | AI systems that underfit need controlled treatment of performance limitations and deployment decisions. |
| Recommendation — Document and treat underfitting as a managed AI risk before relying on the system operationally. | ||
Practitioner Guidance
What to watch for: If training and validation performance are both poor, resist the urge to tune for more confidence before confirming whether the model is simply too simple for the problem. The first question is usually whether the learning setup can represent the target relationship at all.
Governance implication: Teams should treat underfitting as a design and validation issue, not just a modelling nuisance. A model that cannot learn the signal should not be relied on for decisions that require fine-grained discrimination, even if it is easy to deploy and explain.
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org