How do I mark a finding as a false positive?

Steps

1. Find the finding on Issues or on a scan's Findings tab.
2. Read the Evidence tab, with its request, its response and its reproduction steps.
3. Pick False Positive from the Disposition menu.
4. Write what you checked in Notes, so the next reader can follow your reasoning.
5. Click Update status.

Good to know

A false positive is a report of a problem that is not really there, such as a note about a weakness that your own code already blocks in a way the scan could not see. Be sure before you close one. Run the reproduction steps on a system you may test. If you are unsure, ask a developer who knows that part of the code, because a wrong close hides a real problem.

• Write your notes before you click Update status, because that click saves them.
• The finding stays in your history under the False Positive triage state, which means anyone on your team can look it up later and read the reasoning. It does not vanish.
• To hide closed findings from the Issues list, use the triage chips and the Hiding switch.
• Wrong call? Set the disposition back to Open (reopen).

Future scans respect dispositions, so your decision carries forward. The change also appears in the Activity feed as a Triage · Issue entry.

This differs from accepted risk. Accepted risk means the problem is real and you chose to live with it. Read how to mark a finding as accepted risk for that. The Knowledge Hub explains the term false positive.

Related questions

• How do I change a finding's status?
• How do I mark a finding as accepted risk?
• How do I add notes to a finding?
• How do I reopen a finding I closed?
• How do I hide fixed and false-positive findings from the Issues list?

Full tutorial

How to triage findings in Cyberlop: disposition, assignee and notes

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre