False positives

A false positive is a finding that looks like a vulnerability but is not one. NoScope works hard to keep false positives off your dashboard, and gives you a clear way to handle the few that get through.

​

How NoScope checks findings

Before a finding appears on your dashboard, a separate validation agent reviews it. This agent tries to prove the finding wrong. It checks the evidence, repeats the important steps, and confirms the impact.

• If the validation agent confirms the finding, it appears as Open.
• If the validation agent thinks the finding is not real, it marks it as False positive and writes down why.

​

Review a proposed false positive

Findings marked False positive by the validation agent are hidden from the findings table by default. To see them, set the status filter to All or False positive.

​

Mark a finding as a false positive yourself

If you find that an Open finding is not a real issue, change its status to False positive from the status menu on the finding, or select several findings in the table and use Change status. When you add a note to a finding marked False positive, you can save the note as the reason. Your team will see this reason later.

​

False positive or Risk Accepted?

• Use False positive when the finding is wrong: the vulnerability does not exist.
• Use Risk Accepted when the finding is real, but you decided not to fix it. For example, the risk is low or another control protects you.

Retests do not change findings that are marked False positive or Risk Accepted.