Precision and Recall
Precision and recall are two complementary accuracy metrics for detection tools: precision is the share of reported findings that are correct (true positives over all reported), and recall is the share of all real issues that were found (true positives over all actual issues).
Precision and recall measure two different failure modes of any detector, including a security scanner. Precision = true positives / (true positives + false positives) answers 'when the tool flags something, how often is it right?' Recall = true positives / (true positives + false negatives) answers 'of all the real issues that exist, how many did the tool catch?'
The two are in tension. A tool can achieve high precision by only reporting findings it is very sure about, but that risks missing real issues (low recall). Conversely, flagging everything maximizes recall but floods users with false positives (low precision). The F1 score, the harmonic mean of precision and recall, is a common single number that balances the two.
For developers evaluating a security scanner, precision predicts how much triage noise you will face, while recall predicts how much you might miss. High-precision, narrow-coverage tools trade some recall for trustworthy output; broad tools may catch more but require heavier triage. Understanding both numbers — and how they were measured — is essential to judging a scanner honestly.