True Positive

Expanded Definition

A true positive is a detection result that matches an actual condition of interest, such as a confirmed vulnerability, malicious event, policy violation, or quality defect. In security operations, the term is used across scanners, SIEM correlation rules, EDR detections, and review queues, but the meaning stays consistent: the tool or analyst identified something real. The concept is distinct from false positive, where an alert looks suspicious but is not actually a problem, and false negatives, where a real issue is missed entirely.

For security teams, the practical question is not whether a true positive exists in isolation, but whether the detection logic captures the right class of risk with acceptable precision. That makes true positive rate a useful measure, but only when paired with business context and triage cost. NIST’s control language in NIST SP 800-53 Rev 5 Security and Privacy Controls is often used to anchor how organisations treat security findings, evidence, and response actions, even though the standard does not define true positive as a formal control term. The most common misapplication is treating any alert that reaches a human analyst as a true positive, which occurs when teams confuse investigation activity with confirmed security impact.

Examples and Use Cases

Implementing true-positive analysis rigorously often introduces triage overhead, requiring organisations to weigh detection sensitivity against analyst time and operational noise.

• A vulnerability scanner flags an internet-facing service with a known CVE, and validation confirms the exposed version is actually deployed. That alert is a true positive because the risk is real and actionable.
• An EDR platform detects a credential dumping tool on an endpoint, and the process lineage, file hash, and command line all match known attacker behaviour. The finding is a true positive if forensic review confirms malicious execution.
• A SIEM rule identifies impossible travel for a user account, and investigation shows the session came from a compromised VPN path rather than a roaming employee. The alert is a true positive because suspicious activity did occur.
• An IAM review finds an active account with administrative rights that should have been removed during offboarding. If the entitlement still exists, the control finding is a true positive and indicates a governance failure.
• In application security, a static analysis tool reports a hard-coded secret, and code review confirms a valid API key is present in the repository. This is a true positive because the secret can be abused directly.

Teams should separate confirmed true positives from merely plausible leads, especially when reviewing high-volume tools or workflows. For broader triage discipline, practitioners often map detections to the control outcomes described in NIST SP 800-53 Rev 5 Security and Privacy Controls and then decide which alerts require containment, escalation, or documentation.

Why It Matters for Security Teams

True positives matter because they define whether detection engineering is surfacing real risk or only generating workload. A team that cannot distinguish true positives from false positives will either overreact to noise or underreact to credible threats. That weakens incident response, distorts reporting, and makes tuning decisions unreliable. In mature security operations, the term also affects governance because confirmed findings often become evidence for remediation tracking, audit response, and control validation.

The identity angle is especially important when detections involve NHI, service accounts, API keys, or agentic AI tool access. A true-positive finding in these areas often points to stale secrets, overprivileged automation, or compromised non-human workflows rather than a simple user mistake. That makes the quality of triage directly relevant to PAM, secrets governance, and identity lifecycle controls. Teams also rely on formal response expectations in sources such as NIST SP 800-53 Rev 5 Security and Privacy Controls when deciding whether a validated detection becomes a ticket, a containment action, or a reportable event. Organisations typically encounter the operational cost of true positives only after an incident backlog or audit finding reveals that confirmed alerts were not being closed into action, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• True Positive Rate
• Cost per true positive
• What is the difference between access review and true NHI governance?
• What is the difference between sandbox mode and true network isolation for AI workloads?