False positive
A reported finding that turns out not to be a genuine issue in your environment.
Scanners infer from version numbers and banners, so they frequently flag issues that a backported vendor patch has already fixed, or that a configuration makes unreachable.
Validating findings is a core part of testing, and a report that has not been validated wastes remediation effort. The mirror problem, a false negative, is worse but harder to notice.
Where this comes up
False positive sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Vulnerability scan An automated check of systems against a database of known vulnerabilities and misconfigurations. Proof of concept A demonstration that a vulnerability is genuinely exploitable, rather than theoretically present. Risk rating The severity assigned to a finding, ideally accounting for your environment rather than the raw score alone. Penetration test An authorized simulated attack against your systems to find and demonstrate exploitable weaknesses before a real attacker does.