A false positive in security is an alert that flags normal, harmless activity as a threat. A legitimate admin script flagged as malware, a traveling employee’s login flagged as account takeover, or a genuine invoice email quarantined as phishing are all false positives. Each one takes time to investigate or fix, even though nothing bad happened.
At a glance
- A false positive is a wrong alarm; a false negative is a real attack with no alarm.
- Some false positives are unavoidable, because detection rules trade sensitivity against noise.
- High false positive rates drive alert fatigue, where real alerts get ignored.
- Tuning, context and correlation reduce them; switching rules off can create blind spots.
- Many MDR and SOC services filter false positives as part of triage, with varying depth.
What problem it solves
Understanding false positives helps buyers judge security tools and services by what matters. Detection tools look for patterns that may indicate an attack, but many of those patterns also appear in normal work: an IT admin running PowerShell, a user logging in from a new country, a large file upload to a cloud drive. A rule sensitive enough to catch attackers will often catch legitimate users too.
When false positives pile up, teams stop trusting alerts. Analysts skim, close tickets in bulk or tune detections down to quiet them, and a real intrusion can slip by in the noise. For a small IT team, the volume alone can make a security tool more burden than help. When users’ legitimate work is blocked, they look for workarounds. Measuring and managing false positives is therefore part of whether a detection program actually works.
How it works
Why they happen. Detections rely on rules, signatures, behavior models or machine learning, each matching activity that resembles attacks. Without context, such as who the user is, whether the activity is scheduled, or whether the file is a known internal tool, the system can’t tell the difference.
Triage. An analyst or automated playbook reviews the alert, checks related data and decides whether it is a true positive (real threat), a false positive or a benign true positive (the activity really happened but is authorized, such as a sanctioned penetration test).
Tuning. Common fixes include adding exceptions for known-good software or accounts, adjusting thresholds, adding asset and user context, and retiring rules that never find anything real. Each change should be documented, because exceptions can be abused.
Correlation. Security information and event management (SIEM) and XDR tools use event correlation to combine weak signals from several sources, raising confidence before alerting a human.
Feedback. Analysts mark outcomes so the false positive rate can be tracked and detections improved over time.
When it matters for buyers
- When evaluating detection tools. Ask how alert volume and false positives are measured in environments like yours, and run a proof of concept on your own data.
- When buying MDR or a SOC service. A big part of what you pay for is triage; check what reaches you and how quickly. Our managed detection and response and SIEM overviews cover the trade-offs.
- When a tool blocks legitimate work. Email filters, endpoint tools and web gateways can quarantine real business activity; check how quickly exceptions are handled.
- When reviewing service reports. Alert counts alone can mislead; look at what was investigated, escalated and found to be real.
Questions to ask vendors
- What share of alerts that reach our team were real incidents last quarter, and how do you measure it?
- How do you tune detections for our environment, and how long does initial tuning take?
- Who approves exceptions, and how are they documented and reviewed?
- How do you make sure tuning to reduce noise doesn’t create blind spots?
- Can we see examples of escalated alerts with the triage notes?
How it differs from alert fatigue
A false positive is a single wrong alert. Alert fatigue is what happens to people when wrong or low-value alerts arrive in such volume that they stop paying close attention. False positives are one of the main causes of alert fatigue, alongside duplicate alerts and alerts that are technically real but not worth acting on.