In threat detection metrics, which term describes a benign item that is incorrectly flagged as malicious?

• A. True Negative
• B. False Positive
• C. True Positive
• D. False Negative

Answer: (B)

In threat detection metrics, a benign item flagged as malicious is called a false positive. It happens when something harmless is labeled as malware or a threat, even though it isn’t harmful in reality. The actual state is negative (benign), but the detection result is positive (malicious), so the label doesn’t match the truth. This differs from a true positive, where a real threat is correctly identified; a true negative, where a benign item is correctly not flagged; and a false negative, where a real threat slips through undetected. For example, a legitimate software update that trips a malware alert is a false positive. Understanding false positives helps balance detecting true threats with avoiding unnecessary alerts and alert fatigue.