# What are false positives and false negatives?

A false positive is an alert about something harmless: the tool says attack, but it was a backup job or a new piece of software. A false negative is an attack the tool missed. Every detection tool makes both kinds of mistake, and the two pull against each other: make the tool more sensitive and you get more false alarms, make it quieter and you miss more. Too many false positives are dangerous in their own way, because people stop reading alerts. When you compare tools, ask how they handle false alarms and how you mark one, rather than trusting a single accuracy number.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-are-false-positives-and-false-negatives

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What is a SOC (security operations centre)?](https://netsenx.com/en/faq/what-is-a-soc-security-operations-centre)
- [What is a CSIRT or CERT?](https://netsenx.com/en/faq/what-is-a-csirt-or-cert)
- [What is a penetration test?](https://netsenx.com/en/faq/what-is-a-penetration-test)
- [What are red teams and blue teams?](https://netsenx.com/en/faq/what-are-red-teams-and-blue-teams)
- [What is a vulnerability scan?](https://netsenx.com/en/faq/what-is-a-vulnerability-scan)