What is False positive?
A reported issue that is not actually exploitable. The noise that makes scanner output expensive to triage — and the reason reproduction matters.
False positive: A reported issue that is not actually exploitable. The noise that makes scanner output expensive to triage — and the reason reproduction matters.
In plain language
A false positive is a scanner crying wolf: a signature matched, but the issue is not real or not reachable. Every false positive costs an engineer’s time to disprove, and enough of them train teams to ignore the tool entirely.
SuperPentest’s answer is a hard rule: a candidate is not a finding. Nothing is reported until it is reproduced from a clean session with replayable evidence, so what reaches your team is verified, not suspected. How findings are verified →
A concrete example
A scanner reports “SQL injection” on a search box because a quote in the input changed the response. An engineer spends an afternoon confirming the query is parameterised and the result was a rendering quirk — a false positive that cost real time. Multiply by dozens and the team stops reading the tool. Reproduction-first testing only surfaces the issue if it can actually be exploited.
Related
How findings are verified → · Clean-session reproduction →
Want this tested on your app? Book a demo or read how findings are verified.