Cybersecurity glossary
What is a False Negative?
Learn what a false negative is in cybersecurity, why scanners and detections miss real threats, the risk of silent failures, and how to improve coverage without drowning in noise.
Definition
A false negative is a failure to report a real vulnerability, intrusion, or policy violation that should have been detected—leaving risk invisible to operators until exploitation, audit, or manual review reveals it.
The failure mode you do not hear
Dashboards celebrate green. Attackers celebrate false negatives—the vulns never ticketed, the beacons never alerted, the authz bypass no SAST rule understood. Silent failure is the most expensive scanner output.
Security programs must hunt for what tools cannot see.
How real issues stay invisible
Coverage never includes the asset
Shadow APIs, forgotten subdomains, and unscanned cloud accounts sit outside tools.
Checks are too shallow
Version-only CVE matches miss config-driven flaws; unauthenticated crawls miss authz bugs.
Signatures lag adversaries
New exploit paths and living-off-the-land behaviors evade static rules.
Over-tuning hides signal
Broad suppressions and high thresholds drop true events with the noise.
Process never validates detections
No purple tests means “we assume the alert works” until an incident proves otherwise.
FN hotspots by domain
Vulnerability management
Unauthenticated scans, bad inventories, and logic vulnerabilities.
Application security
BOLA/BFLA, business logic abuse, and multi-step workflows.
Detection engineering
Missing telemetry fields or ATT&CK techniques never tested.
Identity threats
Token replay and consent abuse that look like normal SSO.
Shrinking the silent gap
| Practice | Why it helps |
|---|---|
| Asset & API discovery | You cannot detect issues on systems you do not know exist |
| Authenticated / gray-box testing | Reveals classes black-box automation routinely misses |
| Purple team retests | Proves detections fire on real techniques |
| Multi-engine correlation | One tool’s FN may be another’s catch |
| Incident retrospectives | Convert breaches into permanent coverage items |
- Treat “0 findings” as a coverage question, not a celebration.
- Review suppressions for rules that would hide high-impact techniques.
- Maintain an ATT&CK coverage map with tested vs assumed detections.
- Schedule pentests specifically against areas scanners under-serve.
- Log when attackers succeeded without alerts—and fix that pipeline.
- Prefer high-signal detections over deleting entire noisy categories.
- Include business-logic test cases in CI for critical money paths.
- Re-onboard telemetry after major platform migrations.
The practical takeaway
A false negative is a missed real issue. Balance noise reduction with deliberate tests that prove you can still see what matters.
Green boards are only comforting when you have independently verified they are not blind.
Related security terms
False Positive
Opposite error type that often drives over-tuning into false negatives.
Purple Team
Practice designed to discover and close false-negative gaps.
Blue Team
Owns detection coverage and response to missed techniques.
Penetration Testing
Independent testing that frequently finds issues scanners missed.
Exploitability
Real issues may be missed when tools only check shallow indicators.
Frequently asked questions
What is a false negative in simple terms?
It is when something bad is really there—a bug or an attack—but your tools or process say everything is fine.
Why are false negatives often worse than false positives?
False positives waste time. False negatives hide danger until attackers or auditors find it for you.
What causes scanner false negatives?
Missing authenticated checks, incomplete signatures, shadow assets, WAFs masking apps, and logic flaws tools cannot model.
Can tuning for fewer false positives create false negatives?
Yes. Aggressive suppressions and raised thresholds commonly blind detections to real events.
How do you discover false negatives?
Pentests, bug bounties, purple teaming, incident reviews, and comparing multiple scanners or data sources.
Is “clean scan” evidence of no false negatives?
No. It only means that tool found nothing in its coverage model.
How should leaders talk about FN risk?
As coverage and assurance limits—pair automated scanning with testing and detection validation.
References
Explore authoritative guidance and frameworks related to false negative.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.