True Positive Vulnerability
A true positive vulnerability is a reported finding that has been verified as a genuine weakness through code review, context analysis, and reachability assessment.
Primary question: What constitutes a true positive vulnerability and how is it distinguished from a false positive?
Direct answer
A true positive vulnerability is a reported security finding that has been verified as a genuine weakness — reachability, exploitability, severity, and business impact are assessed separately for prioritization and treatment
A true positive vulnerability is a finding that has passed verification — the reported weakness is genuine and the data flow exists. Verification involves examining the reported code location and tracing the data flow from source to sink. Reachability, exploitability, severity, and business impact are assessed separately for prioritization and treatment, not as part of the true-positive classification.
True positives require a documented risk-treatment decision. They represent genuine weaknesses that, if exploited, could compromise the application's confidentiality, integrity, or availability. Remediation should be prioritized based on severity, exploitability, and business context. Low or absent current exploitability does not make a real weakness a false positive.
Definitions
True positive vulnerability
A reported security finding whose asserted weakness exists under the defined validation criteria. A true positive establishes that the reported weakness exists. Reachability, exploitability, severity and business impact are assessed separately for prioritization and treatment.
Verification
The process of confirming whether a reported finding represents a genuine vulnerability by examining code context and data flow. Exploitability and reachability are assessed separately after validity is established.
The engineering problem
Security teams may treat all reported findings as true positives, wasting effort on false positives while genuine vulnerabilities may be dismissed prematurely.
Without structured verification, teams may incorrectly classify false positives as true positives (wasting effort) or true positives as false positives (leaving vulnerabilities unaddressed).
Automated triage tools may incorrectly classify findings. Organizations may require human review for high-severity findings, ambiguous cases, and policy exceptions as a governance policy.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Verification process
Finding verification- Artifact
- A reported finding examined for validity and data flow completeness.
- Risk
- Misclassifying a true positive as a false positive; misclassifying a false positive as a true positive.
- Output
- A verified classification — true positive or false positive — with documented reasoning.
Evidence:
Remediation assignment
True positive remediation- Artifact
- A verified true positive vulnerability assigned for remediation with documented severity, exploitability, and business context.
- Risk
- Delayed or missed remediation of verified vulnerabilities.
- Output
- A remediated vulnerability with documented review and re-verification evidence.
Evidence:
Verification workflow
- A security analysis tool reports a finding.
- The finding is verified through code review, context analysis, and reachability assessment to confirm the asserted weakness exists.
- If verified as a true positive, it is assigned for remediation with documented severity and exploitability context.
- The fix is implemented, reviewed, and re-verified through re-analysis or independent testing.
- If verified as a false positive, it is documented with rationale and dismissed.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST analysis with DerTriage and DerCodeFix available within static analysis to support finding review.
DerScanner performs static analysis and provides DerTriage and DerCodeFix, which are available within static analysis to support finding review. [derscanner-sast]
Limits of verification
- Verification requires security expertise and code knowledge. It cannot be fully automated.
- A true positive in the tested environment may not be exploitable in production due to different deployment configuration or runtime conditions.
- Two analysis tools may both miss a true positive due to the same blind spot.
Related knowledge
Vulnerability Verification
The verification process that determines true vs. false positives
Relationship: related-toFalse Positive Vulnerability
The complementary concept — a verified non-vulnerability
Relationship: related-toVulnerability Exploitability Analysis
Assessing whether a true positive is exploitable
Relationship: related-toValidate SAST Findings
How to validate individual SAST findings for accuracy
Relationship: related-toCanonical terms used: True positive vulnerability; Verified genuine vulnerability; Confirmed vulnerability; Valid finding.
Evidence and references
- DerScanner SAST documentationDerScanner performs static analysis of supported source and binary formats, provides configuration-file analysis, and reports and compares analysis results. DerTriage and DerCodeFix are available within static analysis.
derscanner-sast
True positive