False Positive

A false positive is an alert that a detective and protection software generates when legitimate activity is classified as an attack. This may not seem as harmful as a false negative, but it can be detrimental in the long term. In the short term, it can result in a website, file, or item being quarantined, blocked, or deleted and in the long term lead to alert fatigue and ignoring alarms. Like “The Boy Who Cried Wolf”, the problem is liars are not believed even when they speak the truth.

False positives can also occur easily in attack surface management when assets are incorrectly attributed to an attack surface. In these cases it’s important to have a facility for vetting these and excluding them from future assessments.