False positives: the silent plague of scanners

The problem everyone knows

You run a scanner. It spits out 400 red alerts. You take a deep breath and start triaging. Two days later you realise 380 were false — reflections, noise, misread cases.

The worst part isn’t the wasted time. It’s that eventually nobody reads the reports anymore. And the day a real critical flaw shows up, it slips by unnoticed among the false ones.

Precision and recall: both matter

A scanner is measured on two axes. Recall: does it miss real flaws? Precision: does it invent false ones? A scanner that screams at everything has high recall — but catastrophic precision.

Precision without recall is worthless, and vice versa. The honest goal is both at once: find everything that exists, and nothing else.

The fix: prove, don’t guess

The difference between a detection and a proof is the replay. Once a flaw is suspected, it is re-tested: reproduced under the same conditions, compared to a baseline response, checked for a stable and expected signal.

If it doesn’t reproduce, it’s dropped — before it even reaches the report. What remains is real, defensible to a developer and an executive alike.

A limit we own

No scanner is perfect. On the OWASP Benchmark, SauronSec reaches ~100% detection on five vulnerability classes (SQL, command, XSS, XPath, LDAP injection) with zero false positives — but caps at 56.4% on path traversal, because some cases are blind.

We show it rather than hide it. A scanner that claims to be perfect everywhere is lying about at least one thing. Trust is earned line by line.

What it changes for you

A report with zero false positives is a report you can follow from the first point to the last without second-guessing. Every line is an action to take, not a hypothesis to verify.

That’s the whole philosophy of SauronSec: never waste your time on a false alarm.