What are false positives and false negatives?

A false positive is an alert about something harmless: the tool says attack, but it was a backup job or a new piece of software. A false negative is an attack the tool missed. Every detection tool makes both kinds of mistake, and the two pull against each other: make the tool more sensitive and you get more false alarms, make it quieter and you miss more. Too many false positives are dangerous in their own way, because people stop reading alerts. When you compare tools, ask how they handle false alarms and how you mark one, rather than trusting a single accuracy number.

← All 69 questions on What is…? Network and security termsAll topics