What it means
Every classification or detection process can make errors. A false positive creates an alert or block for activity that should have been accepted. A false negative allows or overlooks activity that should have been identified. The balance affects both operational workload and security risk.
How it works
Thresholds, data quality, model assumptions, environmental differences, and incomplete context influence error rates. Lowering a threshold may catch more true activity but also create more false positives. Raising it can reduce noise while increasing missed events. Tuning requires representative data and a clear understanding of consequences.
A login rule that alerts on every overseas connection may flag legitimate travelers, while a rule that trusts all familiar devices may miss an attacker using a stolen session. Analysts need context, feedback, and layered detection to improve both outcomes.
Practical focus
- Measure precision, recall, and operational impact where appropriate
- Label closed cases and feed outcomes back into tuning
- Prioritize false negatives with high consequences
- Use multiple signals instead of relying on one weak indicator
Common mistakes
- Celebrating lower alert volume without checking what was missed
- Treating analyst disagreement as proof that one side is wrong
- Tuning only against historical attacks and ignoring changing behavior
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: