false-positives
Safeguard articles tagged "false-positives" — guides, analysis, and best practices for software supply chain and application security.
31 articles
What Is VEX (Vulnerability Exploitability eXchange)?
VEX is a machine-readable advisory that states whether a product is actually affected by a known vulnerability. Here's how its status values work and why it cuts SBOM-driven false positives.
Reducing false positives in secret scanning with context-...
Regex-based secret scanners like GitHub Advanced Security flood teams with false positives. Here's how context-aware LLM reasoning cuts the noise without missing real leaked credentials.
Why Snyk Code's semantic approach produces fewer false po...
Snyk Code cuts SAST false positives using semantic analysis: AST/data-flow graphs plus ML trained on real code, not regex patterns. Here is how the mechanics work.
False Positives vs False Negatives in Security Scanning
False positives in cyber security waste your team's time; false negatives get you breached. Here is how to think about the trade-off and tune for it deliberately.
How to Read and Fix a Checkmarx Vulnerability Finding
A Checkmarx vulnerability is a SAST finding that traces tainted data from source to sink. Here is how to interpret one, confirm it is real, and remediate it.
Reducing false positives in security scanning
Most security scan findings never warrant action. Here's why scanners over-alert, what it costs teams, how Aikido's consolidation approach compares, and what actually cuts false positives.
Customer story pattern: cutting false-positive noise with...
How one team cut AppSec findings 92% and MTTR from 11 days to 36 hours by consolidating scanners — a reduce security tool noise false positives case study.
Solve SCA False Positive Overload With Reachability Analysis
SCA tools produce more findings than any team can review. Reachability analysis is the filter that turns the haystack into a queue your engineers will actually finish.
SAST Vendors Compared: How to Choose a Static Analysis Tool
Choosing among SAST vendors comes down to language coverage, false-positive rate, developer workflow fit, and how the results reach the people who fix code.
Anthropic's Mythos Vulnerability Scanner: An Honest Assessment of Strengths, Weaknesses, and Reasons to Be Cautious
Anthropic's Mythos model is generating buzz for AI-powered vulnerability detection. We break down what it does well, where it struggles, and why security teams should approach the results with healthy skepticism.
The Limits of Single-Model Vulnerability Scanning: A Technical Analysis of the Mythos Approach
Anthropic's Mythos model claims to find vulnerabilities in open-source code using a single LLM. We analyze where this approach falls short and why production-grade zero-day discovery requires Safeguard's Multi-Agent TAOR Deep Think AI Engine.
Why LLM-Based Vulnerability Scanning Needs More Than a Single Model
Large language models are being used to find vulnerabilities in open-source code. But a single model, no matter how capable, isn't enough. Here's why multi-agent orchestration, structured CWE analysis, and deep context matter more than model size.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.