Method and Device Relating to Decision-Making Threshold

A method for determining a Decision-Making Threshold, DMT, comprising obtaining environment threat data (104) comprising one or more events, each event associated with a label providing an indication of a threat event. The method further comprises obtaining the target metric scores (204); computing anomaly predictions relating to if the events are malicious or not and comparing the anomaly predictions with a DMT to obtain malicious threat predictions. The method further comprises computing current metric scores (303) for the environment threat data using at least the labels and the malicious threat predictions for the environment threat data; comparing the computed current metric scores with the target metric scores and adapting the DMT depending on if the computed metric scores are within a range of the target metric scores or not.