false-positives
Safeguard articles tagged "false-positives" — guides, analysis, and best practices for software supply chain and application security.
31 articles
Reading an OWASP Benchmark Score Without Being Sold To
A tool that flags every test case scores 100% detection on the OWASP Benchmark. Recall is the number vendors quote and the one that means least — here is what the suite actually measures.
Recall Is Easy. Your SAST Tool's Real Metric Is the Mute Rate
Any scanner can find every vulnerability by flagging everything. The number that decides whether a tool survives contact with a development team is how often it is wrong.
Running the OWASP Benchmark Against Your Own SAST Engine
A scanner with no measured accuracy is a scanner with claimed accuracy. Wiring up the OWASP Benchmark gives you one number that survives scrutiny — and usually finds a crash on the way.
"Not Demonstrated" Is Not "Not Vulnerable"
Exploitability is not a boolean. Collapsing it into one loses the only state that tells a developer what to do next — and quietly converts every unanswered question into a dismissal.
SAST Tooling: How to Choose and Run Static Analysis That Developers Trust
SAST tooling scans your source code for security flaws before it runs, but the tool you pick matters less than how you tune it. Here is how to choose, integrate, and keep the noise down.
Reducing false positives in SAST and SCA tools
NIST benchmark data puts some SAST false-positive rates near 78%. Reachability analysis and contextual triage are how teams cut that noise without missing real risk.
Where AI actually helps AppSec — and where it quietly makes things worse
One 2025 benchmark found an LLM filter cut Semgrep's false positives by 88.6% — while a separate study found GPT-4 alone flagging vulnerabilities was wrong more often than right.
A vendor-neutral framework for evaluating SAST tools
OWASP's Benchmark suite has run 2,740 fixed Java test cases since 2016, yet most SAST comparisons still amount to a vendor's self-reported false-positive number.
What Is Reachability Analysis in Security?
Reachability analysis determines whether a vulnerable piece of code can actually be executed from your application — cutting through the noise of vulnerabilities that exist but can never be triggered. Here's how it slashes false positives.
False Positives in Security Scanning FAQ
Why security scanners produce so many false positives, what actually counts as one, and how reachability analysis and context reduce the noise. A practical FAQ.
False Positives vs False Negatives: What's the Difference?
A false positive flags something safe as dangerous. A false negative misses something dangerous entirely. One wastes your time; the other gets you breached.
Reachability Analysis FAQ: What It Is and Why It Cuts Noise
Reachability analysis decides whether a vulnerable function in a dependency is actually called by your code. Here are the common questions, answered plainly.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.