True Positives, False Positives and the Cost of Both

What is it?

A true positive is an alert that correctly identified unwanted activity. A false positive is an alert that fired on legitimate activity. A false negative is unwanted activity that produced no alert at all — the one you never see.

Why it matters

New analysts assume their job is to catch attackers. It is actually to produce accurate verdicts. An analyst who marks everything malicious is as useless as one who marks everything benign — both have stopped adding information.

Where you see it

Vulnerability scanners, backup agents, monitoring tools, software updaters, corporate VPNs and administrators doing legitimate work are the most common sources of false positives in any enterprise.

What normal looks like

Benign activity is usually repeatable, scheduled, attributable to a known account or service, and consistent with the host's role. A backup agent connecting to the same destination every night at 03:00 fits all four.

What suspicious looks like

Malicious activity tends to break at least one expectation: an unusual parent process, an account acting outside its normal hours or systems, a destination nobody else in the organisation contacts, or timing that does not match any schedule.

How analysts investigate

Establish the baseline before judging the observation. Ask whether this host, this account, or this organisation has done this before. A behaviour that is rare across the estate but routine for one server is usually explained by that server's role.

Common beginner mistakes

Concluding 'malicious' from a tool's reputation score alone, without checking who ran it and why.
Marking an alert benign because it looks familiar, without confirming the account and timing match the expected pattern.
Failing to write down why it was a false positive, so the next analyst repeats the whole investigation.

Both kinds of error cost the organisation, but they cost it differently, and understanding the asymmetry is what makes triage a judgement rather than a reflex.

Error	What it costs
False positive	Analyst hours, and eventually alert fatigue — the team starts ignoring the rule that cried wolf.
False negative	Undetected intrusion time. This is the expensive one, and you will not know it happened.

Is this behaviour repeatable and scheduled?
Is the account or service one that legitimately performs this?
Does the timing match a known maintenance or business window?
Do other hosts with the same role behave identically?
If you answered yes to all four, benign is the defensible verdict — write down the evidence.

The alert that looks malicious and isn't

An alert fires: 'Host 10.20.1.30 performed 4,000 connection attempts across the network in two minutes.' It reads like a scan. Work the four baseline questions before you call it.

Attribute the host: what is 10.20.1.30?
The asset inventory says it is VULN-SCAN-01, the authorised vulnerability scanner. That single fact reframes 4,000 connections from 'attack' to 'its job'.
Check repeatability and schedule.
It runs the same sweep every Tuesday 02:00; today is Tuesday 02:01. Repeatable ✓, scheduled ✓, attributable ✓.
Look for the one thing that would break the benign story.
Its targets are the internal ranges it always scans — none external, none new. Verdict: FALSE POSITIVE. Write it down (host, schedule, targets) so the next analyst closes it in seconds, not an hour.

Quick check

The SAME 4,000-connection pattern comes from HR-LAPTOP-88 at 14:30, targeting external addresses it has never contacted. Same verdict?

A quick self-check — it doesn't affect your XP or progress.