A true positive in cyber security is a correct detection: the security tool raised an alert, and there really was a genuine threat or vulnerability behind it. Understanding what a true positive in cyber security is, and how it sits against false positives, true negatives, and false negatives, is the foundation for judging whether any detection tool, from a vulnerability scanner to an intrusion detection system, is actually earning its place. These four outcomes come from a two-by-two confusion matrix, and every conversation about detection accuracy runs through them.
The four outcomes
Every alert (or non-alert) falls into one of four boxes, defined by two questions: did the tool fire, and was there really something there?
- True positive: the tool alerted, and the threat was real. A scanner flags a vulnerable dependency that is genuinely vulnerable and reachable.
- False positive: the tool alerted, but there was no real threat. The scanner flags a "vulnerability" that does not apply to your configuration.
- True negative: the tool stayed quiet, and correctly so. Nothing was wrong and nothing was reported.
- False negative: the tool stayed quiet, but there was a real threat it missed. This is the most dangerous outcome.
Understanding true positive and false positive in cyber security together is essential because they are the two "the tool fired" cases, and telling them apart is what triage actually is.
Why the true positive is the goal, but not the whole story
A true positive is what you want your tools to produce: real signal about real problems. But you cannot judge a tool on true positives alone. A system that alerts on literally everything will catch every real threat (great true-positive rate) while burying analysts in noise (terrible false-positive rate). Conversely, a system tuned to alert almost never will have few false positives but miss real attacks as false negatives.
The trade-off between catching everything and staying quiet is the central tension in detection engineering. A useful tool maximizes true positives while keeping both false positives and false negatives low, and those goals pull against each other.
False positives: the tax on trust
The false positive meaning in cyber security is an alert that turns out to be nothing: the tool cried wolf. False positives are not harmless. They consume analyst time, and worse, they erode trust. A team drowning in false positives starts ignoring alerts, and eventually a real true positive gets dismissed as "probably another false alarm." That is how false positives cause missed breaches indirectly.
In application security specifically, false positives are the number-one complaint about scanners. A tool that reports a CVE in a dependency that your code never actually calls has produced a technically-true-but-practically-irrelevant finding, which many teams reasonably treat as a false positive because it wastes effort. Reachability analysis, which checks whether vulnerable code is actually invoked, is one technique for converting those noisy findings into either confirmed true positives or dismissible non-issues. Our SCA product page goes deeper on how prioritization cuts that noise.
True negatives and false negatives
The true negative in cyber security is the quiet, correct outcome: the tool did not alert because there genuinely was nothing to report. True negatives are the bulk of normal operation and are easy to overlook precisely because nothing happens.
The false negative is the outcome that keeps defenders up at night: a real threat the tool failed to detect. A missed vulnerability, an intrusion that slipped past the sensor, malware the scanner did not recognize. False negatives are dangerous because you do not know they happened; there is no alert to investigate. This is why security teams accept some false positives as the price of keeping false negatives low. Given the choice, most would rather chase a few false alarms than silently miss a breach.
Measuring detection quality
The four outcomes combine into standard metrics:
Precision = TP / (TP + FP) "when it alerts, how often is it right?"
Recall = TP / (TP + FN) "of all real threats, how many did it catch?"
- Precision answers how trustworthy an alert is. Low precision means a flood of false positives.
- Recall (also called the true-positive rate) answers how much you are missing. Low recall means false negatives are slipping through.
No tool maxes both. Vendors who advertise "zero false positives" are usually trading away recall, and a tool that catches everything is usually swamping you with false positives. When you evaluate a security product, ask about both numbers, not just the flattering one.
Applying this to triage
For a working analyst, the practical loop is: an alert arrives (a positive), and your job is to determine whether it is a true positive or a false positive. Confirm true positives and route them to remediation; document false positives and, where possible, tune the rule so the same non-issue does not fire again. Good triage is not just closing tickets; it is feeding the outcome back into the detection logic so precision improves over time. A tool that lets you suppress or tune findings, with an audit trail, turns triage into a durable investment rather than repeated wasted effort.
FAQ
What is a true positive in cyber security?
It is a correct detection: the security tool raised an alert and there really was a genuine threat or vulnerability behind it. True positives are the real signal you want a detection tool to produce.
What is the difference between a true positive and a false positive?
Both are cases where the tool fired an alert. A true positive means the threat was real; a false positive means there was no real threat and the alert was a false alarm. Distinguishing the two is the core of alert triage.
Why are false negatives more dangerous than false positives?
A false negative is a real threat the tool missed, and because no alert was raised, you have no signal that anything is wrong. False positives waste time, but false negatives can hide an active breach entirely.
How do precision and recall relate to these outcomes?
Precision is true positives divided by all positive alerts, measuring how trustworthy alerts are. Recall (the true-positive rate) is true positives divided by all real threats, measuring how much you catch. Improving one often worsens the other.