Glossary
False positive
A finding reported by a tool or an analyst that, checked against the real system, does not correspond to an exploitable vulnerability.
- FP
Three distinct situations get labelled false positive and they are not the same thing. The first is a detection error: the tool was wrong and the vulnerability does not exist. The second is a real vulnerability that is not exploitable in that context, for instance because the affected function never receives user input. The third is a real, exploitable vulnerability that someone has decided not to fix — which is not a false positive at all, it is a control exception.
Labelling the third as a false positive is the most damaging shortcut in vulnerability management, because it makes an accepted risk disappear from the file without anyone formally accepting it.
Closing a finding as a false positive should require writing the reason and leaving a trail of what was checked against the source system. It is precisely the kind of decision that should not be automated without explicit human review.