Home / Knowledge hub / False positive
Knowledge hub
False positive
A reported issue that turns out not to be real.
What it means
A false positive is a reported issue that turns out not to be real. NIST puts it simply: an alert that incorrectly indicates a vulnerability is present. A tool matched a pattern that resembled a flaw and reported it without confirming anyone could use it.
Some are obvious inside a minute. The expensive ones look plausible and take half a day to disprove, and that work leaves nothing behind.
Why it matters
Each one costs an engineer an afternoon of proving a negative. Enough of them teach a team to stop opening the report, and that is the real damage. A list nobody reads is worse than no list, because people still point at it when somebody asks what you do about security.
The second cost arrives in the next report. Once a team has been burned, genuine findings get the same shrug as the noise, and the one that mattered waits behind a hundred that did not. Noise spends the credibility of every report that follows, and credibility is harder to earn back than time.
How it shows up
The shape of a finding tells you whether anybody confirmed it. A confirmed finding carries the request, the response it produced, and the line responsible. An unconfirmed one carries a rule name, a location and a severity. That second shape is a research task handed to your team as a ticket.
Confirmed-only mode ships on 19 October 2026 and will report only what we exploited. Today every finding already arrives with its request and response. What a finding contains.
Questions people ask
False positive, answered
Why does our scanner report things that are not real?
Most tools match patterns rather than proving impact. Code that looks like it concatenates user input into a query gets flagged whether or not that input is reachable or already escaped.
Proving exploitability takes a running application, a session and a request. Pattern matching is cheaper, so that is what most tools do.
How do we tune them out without hiding a real bug?
Suppress per finding with a written reason and an expiry date, never by turning off a whole rule across the codebase.
A rule switched off globally hides the next occurrence in a file nobody has written yet. That is how a real bug becomes invisible.
Who should triage them, the security team or the developers?
Whoever can answer fastest, which for reachability is usually the developer who owns the code. The cost is the context switch, so batch the triage rather than interrupting.
Better still, reduce what reaches them. A finding with a request and a response behind it needs almost no triage.
Is a lower false positive rate worth paying more for?
Count the hours first. Multiply the findings you dismissed last quarter by the time each one took, and compare that with the price difference.
For most teams the noise costs more than the tool does. The harder cost to price is the quarter when the team stopped reading.
Are informational findings just false positives with a nicer name?
No, though they get treated that way when a report is full of them. An informational item is real and low impact, such as a missing header on a page with nothing to protect.
The fix is honest rating and separation. We use six tiers, from critical down to best practice, so the low-impact items stay visible without crowding the queue.
Sources
Where this comes from
Related
Terms that sit next to this one
False negative
A real vulnerability that a test failed to find.
Exploit
The specific sequence that turns a suspected weakness into a real one.
Proof of concept
The smallest demonstration that a vulnerability is genuinely real.
SAST
Tools that read your source code without ever running it.
Severity
How bad a finding is, from critical down to informational.
How much of that report is real?
Confirmed-only mode ships on 19 October 2026 and reports only what we exploited. Today every finding still carries the request and the response behind it. Ask to see a sample report.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.