False-Positive Rate
False-positive rate is the proportion of a security tool's findings that turn out not to be real issues; in scanning, a false positive is an alert flagged as a vulnerability that, on inspection, is not actually exploitable or valid.
A false positive is a finding a scanner reports as a problem that is not actually a problem — for example, flagging a code pattern as SQL injection when the input is already validated, or reporting a vulnerability in a code path that cannot be triggered. The false-positive rate captures how often this happens across a tool's output.
Note that 'false-positive rate' is used loosely in the industry. In classification terms it can mean the fraction of truly-safe cases that were wrongly flagged, but practitioners often use it informally to mean the share of a tool's alerts that are wrong — which is more precisely captured by precision (true positives divided by all positives). Because the denominators differ, it is worth confirming which definition a given metric uses.
For developers, false positives are the primary cause of alert fatigue. Every spurious finding costs triage time and erodes trust in the tool, and teams that face too many false alarms often start ignoring the scanner entirely — including the real findings. Reducing the false-positive rate, without sacrificing detection of genuine issues, is a core measure of a scanner's practical value.