Take the union of two scanners if missing a real issue costs more than reviewing extra noise. Take the intersection if review time is scarce and you can accept missing some real issues. The union raises recall and usually lowers precision. The intersection does the reverse.
Setup with made up numbers
Assume 100 real issues exist. Scanner A finds 70 of them and has 80 percent precision, so it also raises about 17 or 18 false alerts. Scanner B finds 60 real ones and has 70 percent precision, so it raises about 26 false alerts.
To keep the math simple, assume the scanners miss and err independently. In practice they do not fully, which we return to below.
Union
An issue is reported if either tool reports it.
- Recall: 1 minus (0.30 times 0.40) equals 0.88, so about 88 real issues found.
- False alerts: up to 17.5 plus 25.7, about 43, if the false alarms differ between tools.
- Precision: about 88 divided by 131, roughly 67 percent.
You gain 18 real issues over the better single tool, and pay roughly 43 false alerts versus 17 or 26. The review load rises from about 87 or 86 items to about 131.
Intersection
An issue is reported only if both tools report it.
- Recall: 0.70 times 0.60 equals 0.42, so about 42 real issues.
- False alerts: independent errors rarely coincide, so only a handful remain.
- Precision: high, often above 90 percent.
You get a short, clean list and miss more than half of what is there.
Why real life differs
Independence is the weak assumption.
- Tools trained on the same advisories miss the same things. Recall of the union rises less than the formula predicts.
- Some false alarms are systematic, such as a test fixture that every tool flags. Intersection helps there. Union does not.
- Duplicate findings across tools inflate the union count unless you merge them. Dedupe by a stable key before you count.
So treat 88 and 42 as the best and worst sides of a range, and measure on your own code. Our post on estimating what two scanners both missed shows how to size what is left over.
A middle path: vote or score
Instead of a hard union or intersection, rank findings by how many tools agree, and review in that order.
- Found by both: review first, high confidence.
- Found by one: review if capacity allows, or if severity is high.
This keeps the union's recall while giving your team a sensible order. It also builds a record: over time you learn which tool is reliable for which class of issue.
Decision guide
- Misses are expensive, such as internet facing services or secrets: union, with a ranked queue.
- Reviews are expensive and the system is low exposure: intersection or a single well tuned tool.
- Unsure: start with the union for one month, measure the extra real issues found per extra hour of review, then decide. The ratio is the same marginal view used in precision versus recall for detection thresholds.
Quick check
Does a second scanner always find more real issues?
Usually some, but how many depends on how different the tools are. Two tools using the same data source will overlap heavily and add little.
How do I avoid counting the same issue twice?
Match findings on a stable key such as package, version and advisory, or file, line and rule, before counting.
Last reviewed: 19 October 2026.
