Rare Threat Detection Under Imbalance

Scenario

You are training a classifier for a supervised learning task where the positive class is extremely rare. Most examples are benign, but missing the rare positives is costly, and a naive model can look good while failing on the cases that matter.

Question

How do you handle extreme class imbalance when training models to detect rare security threats?