What term describes an alarm when no actual attack is in progress?

What term describes an alarm when no actual attack is in progress?

• A. True Positive
• B. False Positive
• C. True Negative
• D. False Negative

Answer: (B)

When evaluating security alerts, you distinguish how the detector’s results align with reality. A false positive is when the system raises an alarm even though there is no actual attack happening. In this scenario, the alarm is a false alarm, a misfire where no incident exists. For contrast: a true positive is an alarm that correctly fires during an actual attack, a true negative is no alarm when nothing is happening, and a false negative is no alarm during an actual attack. False positives can lead to alert fatigue, so defenders tune sensitivity to balance catching real threats with avoiding unnecessary alerts.

When evaluating security alerts, you distinguish how the detector’s results align with reality. A false positive is when the system raises an alarm even though there is no actual attack happening. In this scenario, the alarm is a false alarm, a misfire where no incident exists.

For contrast: a true positive is an alarm that correctly fires during an actual attack, a true negative is no alarm when nothing is happening, and a false negative is no alarm during an actual attack. False positives can lead to alert fatigue, so defenders tune sensitivity to balance catching real threats with avoiding unnecessary alerts.