SECAI Core · phase 7 of 15
False positive
In security scanning, a case that is reported when it should not be.
The Explain card
- Plain English
- A false positive is an alert or finding that gets reported when it should not have been. The scanner says "threat" and there was no threat.
- Example
- A prompt-injection classifier in front of a coding assistant flags a developer's request to "ignore the deprecated function and use the new one" as an attack. The request was legitimate, but it got blocked and the developer lost ten minutes.
- Why it matters
- Every false positive costs analyst time and erodes trust in the control. Tune a guardrail too aggressively and people start routing around it, which is worse than having no guardrail at all.
- Hook
- The smoke alarm that goes off when you make toast.
Where it sits in the deck
Phase 7: AI-Specific Runtime Controls: Guardrails, Limits, and Enforcement
Responsible AI principles must be enforced mechanically — learn the runtime controls that constrain model inputs, outputs, and resource consumption.
