Real world performance evaluation on problem similar to malware detection
Can you measure a proxy measurement that will be measurable even if the system never goes down? For example, does the engineer find “malware” or whatever the analogue is in this situation?

If not, and if it is safe to do so, why not simply take no action in X% of cases and use the data gathered in those cases as evaluation data?