Hume's problem of induction teaches that:

• A. You can't test everything—sampling and judgment are necessary
• B. You can test everything with enough resources
• C. Induction guarantees truth
• D. Observation is irrelevant

Answer: (A)

Induction attempts to generalize from what’s been observed to what is always the case. Hume showed that no finite set of observations can logically guarantee that future cases will behave the same, so universal claims about how the world works can’t be proven just by looking at past events. Since there are always more cases to consider than we can observe, practical reasoning relies on sampling a representative subset and using professional judgment to decide how well those findings apply to the whole.

In cybersecurity audits and risk assessments, this means you test a sample of controls or events rather than trying to verify every possible instance. You evaluate whether the sample is representative, assess the uncertainties, and recognize that conclusions are probabilistic rather than absolutely certain. This approach acknowledges the limits of observation and the need to base decisions on evidence gathered from samples, not on an assumption that everything has been or can be tested.

So, the idea you’re learning is that you can’t test everything—sampling and judgment are necessary.