Why does automated triage reduce false positives in vulnerability management?

TL;DR: Cohere Health automated triage so 51% of findings never reached engineers, and 87% of critical and high alerts were not exploitable or safe to deprioritise, according to Maze. Vulnerability programmes need verdict quality and environmental context, or remediation work gets buried under noise.

Editorial analysis by NHI Mgmt Group, based on content published by Maze: “How Cohere Health cleared 92% of its critical and high findings and got their time back”.

By the numbers:

• 51% of findings were closed automatically, documented and audit-ready.
• 87% of the critical and high findings turned out to be not exploitable or safe to deprioritise.
• 57% of the fixes Maze recommends are low-effort.

Key questions

Q: Why do vulnerability scanners overwhelm engineering teams?

A: Vulnerability scanners overwhelm engineering teams because they produce large volumes of findings, many of which are duplicates, low-context, or already accepted risk.

Q: How does root-cause grouping improve vulnerability remediation?

A: Root-cause grouping improves vulnerability remediation by collapsing many related findings into a single underlying issue, such as one insecure library version, shared misconfiguration, or common deployment pattern.

Q: How should AppSec teams reduce false positives without losing vulnerability coverage?

A: Use contextual analysis that weighs reachability, data flow, and compensating controls before escalating findings.

Practitioner guidance

• Implement environment-aware triage Score findings against live deployment context, compensating controls, and package reachability before creating engineering tickets.
• Require evidence for every disposition Attach a documented rationale to every downgrade, closure, or escalation so the decision remains defensible during audit or review.
• Cluster findings by shared root cause Collapse repeated alerts into one corrective action when a single configuration, dependency, or code path is driving multiple results.

Bottom line: Automated triage only improves security outcomes when it separates reachable exposure from findings that are already neutralised by compensating controls.

Glossary terms: Continuous Vulnerability Management, False Positive, Compensating Control, Root-Cause Clustering

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →