IT Brief Asia logo
Technology news for Asia's largest enterprises
Partner content
Story image

A deeper dive into the false positive quandary

By Contributor
Mon 2 May 2022

Article by Darktrace director of enterprise security APJ Tony Jarvis.

False positives are often used as a key metric by decision-makers trying to identify the effectiveness of a cybersecurity solution. The reasons for this are understandable: organisations are struggling with overstretched and burnt-out teams with ever-increasing workloads, and know the pain involved in dealing with thousands of alerts each day. 

With a lot of the traditional security protections, there never seem to be enough people or hours in a day to go through every alert and identify whether they are genuine threats or if they can simply be dismissed. 

Disruptive false positives

False positives may arise from a binary approach to security that focuses exclusively on matching a signature, or identifying something coming from infrastructure which has been deemed malicious. 

In the case of ‘bad’ public IP addresses, these can be burned down by attackers once they have been identified, and are often later acquired by legitimate businesses. The ownership changes. So it’s no longer ‘bad’, but it may take days or weeks for your threat feeds to tell you this is the case. 

This is the type of false positive organisations should be worried about – not only is it creating overhead for security teams (who then have to manually perform checks), but it results in business disruption at a critical time when new relations are being formed with partners, suppliers or clients.

Interesting false positives

Compare this with an approach that uses AI to understand how every device normally behaves in order to identify deviations that indicate a threat. Unusual activity may not always indicate a live threat, but can point to interesting findings from a compliance perspective. 

Having passwords stored in plain text, using insecure protocols, DNS being tunneled over HTTPS and even pinpointing the use of shadow IT in the cloud are all activities that a security team should have visibility over. Many of these findings often come as a surprise, since an organisation’s existing security stack often doesn’t provide this level of granularity.

How AI filters itself

Managing false positives is time-consuming. For every red flag, security teams must correlate various alerts together and build out a timeline of an attack to identify if and how an environment was infiltrated and what happened thereafter. This process can take hours with traditional tools.

With AI, that situation changes dramatically. AI models are prioritized according to severity, and human operators can easily filter out lower-severity alerts that may point to compliance issues or other interesting-but-not-immediately-threatening events. On top of that, the AI does another level of analysis, asking additional questions about individual alerts to try and work out if they are a part of a broader attack – and stitching multiple alerts together into an overarching incident for a human to review. 

So instead of dealing with hundreds of alerts, an analyst may simply see 5-10 on a daily basis, with all of the investigation already having been done, with all the context immediately available. 

For example, in the case of ransomware, a single-point-in-time analysis may result in a tool detecting encryption and raising an alert to the security team. But ransomware is a multi-stage attack, and encryption on its own is not necessarily malicious. An AI-powered investigation will ask additional questions such as: 

  • How many files were encrypted? 
  • Who initiated the file encryption?
  • How quickly did this happen? 
  • What was seen immediately before and after this activity? 

Why catch rates are misleading

The notion of false positives has become such an issue in the cybersecurity industry that security solutions are often tested independently and assigned a ‘catch rate’ score that measures what percentage of alerts generated are ‘real threats’ – defined by whether they appear on Threat Intelligence lists. Solutions which have a higher catch rate are often viewed more favorably than others, but this loses perspective that there is far more to establishing whether something may or may not be malicious than whether a specific signature exists in a database. What about cases of zero-day threats? If those signatures have not been pushed down to security solutions yet, how are they going to be able to identify such threats? 


It’s understandable that false positives play such an important role in the decision-making process, but metrics must be carefully considered in the wider context of what they represent. Not every false positive is the same: a useful insight on something that isn’t a live threat but may represent a significant hygiene issue should not be measured on the same ground as something that is disruptive and time-consuming to manage and fix. 

The best way to judge a technology is to see how it works in your own environment, to see how it copes with rich and complex datasets that arise from dynamic organisations.

Find more insights and solutions from Darktrace here.

Related stories
Top stories
Story image
Tech job moves
Tech job moves - Adatree, Brother, Databricks, Nutanix & Rubrik
We round up all job appointments from May 20-26, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Customer experience
The importance of service level management to customer experience
Staffing shortages have impacted site reliability engineers in particular since they are under extreme pressure to ensure that digital assets perform at optimum levels 24/7.
Story image
Deloitte expands cloud observability practice with Dynatrace
Deloitte is expanding its cloud observability practice, including DevOps principles, AI/ML, cloud complexity management and software engineering.
Story image
Contact Centre
Leveraging technology in contact centres to reduce attrition rates
Many organisations worldwide have accelerated DX to better respond to changing market drivers and business environments after the disruption of the pandemic.
Story image
Identity and Access Management
The post-pandemic workforce requires secure IAM capabilities
HID Global discusses what identity and access management means for organisations in today's convoluted digital world.
Story image
Multi Cloud
Red Hat updates dev tools, empowers use of hybrid and multicloud
Red Hat has unveiled updates across its portfolio of developer tools, designed to help organisations build and deliver applications faster.
Story image
Vectra AI
Vectra’s inaugural Partner of the Year Awards revealed
APAC companies Baidam, Firmus, ShellSoft and Macnica have been recognised in Vectra AI's inaugural Partner of the Year Awards.
Story image
Check Point
Check Point and CCTV expert join forces to boost protection
The partnership will involve Check Point Quantum IoT Protect Nano Agent being embedded in Provision-ISR’s CCTV cameras for on-device runtime protection.
Story image
Data Center
Preventing downtime costs and damage with Distributed Infrastructure Management
Distributed Infrastructure Management (DIM) can often be a lifeline for many enterprises that work with highly critical ICT infrastructure and power sources.
Story image
Australian space tech startup secures SpaceX support
Space Machines Company has secured the support of SpaceX as a launch partner in carrying SMC's Optimus Orbital Transfer Vehicle to space next year.
Story image
NetApp launches Spot PC, a new Desktop-as-a-Service solution
This is a new managed cloud DaaS solution with security, automation, observability and optimisation capabilities, designed for the needs of today.
Story image
NVIDIA announces a spate of new innovations at Computex 2022
NVIDIA has announced its latest innovations in data center, robotics, content creation, and gaming in a virtual keynote address on the opening day of Computex 2022 in Taipei.
Find out how a behavioural analytics-driven approach can transform security operations with the new Exabeam commissioned Forrester study.
Link image
Knowing the mechanics of retail fraud can greatly improve your chances of preventing an online attack. Read the new infographic by Sift to discover how your business can be prepared.
Link image
Navigating digital fraud and dispute can be tough. The Q4 2021 Digital Trust & Safety Index by Sift can give helpful insights to your business on keeping safe and prepared online.
Link image
Story image
Infosec unveils role-guided cybersecurity training roadmaps
Infosec Skills Roles maps hands-on training and certifications to the 12 most in-demand cybersecurity roles to maximise training efficiency.
Story image
Elevation of Privilege the top 2021 Microsoft vulnerability
BeyondTrust has released its 2022 Microsoft Vulnerabilities Report, finding that Elevation of Privilege is the top vulnerability category for the second consecutive year.
Story image
Hybrid Cloud
Barracuda expands cloud-native SASE platform
"The expansion of Barracuda's cloud-native SASE platform for hybrid deployment models and IIoT environments solves a number of challenges."
Find out how you and your business can prevent being caught out by everything from ransomware to cryptojacking.
Link image
Story image
Aligned Data Centers increases sustainability-linked loan
Aligned Data Centers has increased its sustainability-linked loan from $375 million to $1.75 billion to speed up the next phase of its strategic growth.
Story image
Managed service provider
Barracuda MSP Day 2022 highlights MSP opportunities
Barracuda Networks has released a report showing global services-related MSP revenue is set to increase by more than a third in 2022 compared to 2021.
Story image
The paradox of change, and how to get around it
The business decision to technologically transform should not come from an IT department but from the business itself.
Having secure retail solutions can be a make or break factor for a customers satisfaction. Sift has the expert tools and expertise to keep retail practices safe and customers happy.
Link image
Story image
Cyber attacks
Devastating cyber attacks expected to hit energy sector
Energy executives anticipate life, property, and environment-compromising cyber attacks on the sector within the next two years.
Story image
Digital Marketing
Getty Images delves into the world of NFTs with Candy Digital
Getty Images and Candy Digital, the next-generation digital collectible company, have announced a new multi-year partnership agreement.
Story image
Silver Peak
The path to an adaptive, modern network
Managing and securing the network looks different than it did just two years ago—especially given that most of these networks are made up of multi-generations of infrastructure stitched together over time.
Story image
Informatica, Oracle enter strategic global cloud partnership
Oracle named Informatica as a preferred partner for enterprise cloud data integration and data governance for data warehouse and lakehouse solutions on OCI. 
Story image
Digital Transformation
Harnessing digital innovations to maximise loyalty programmes and improve CX
When it comes to the retail sector, merchants have never had access to so many different client touchpoints and data to understand their customers better.
Story image
Accenture - a collective security approach a driving factor for cyber resilience
With the approaching Davos World Economic Forum upon us, it is even more imperative to discuss the impact of cybersecurity on business operations leading into the future.
Story image
Artificial Intelligence
Frost & Sullivan recognises Genesys as leader in new reports
Frost & Sullivan has recognised Genesys as a leader in the cloud contact centre market for its robust cloud and digital capabilities.
Story image
Ponemon Institute
Email revealed to be riskiest channel for data loss
More than half (60%) of organisations experienced data loss or exfiltration caused by an employee mistake on email in the last 12 months.
Story image
Manhattan Associates
Shortening the click-to-customer cycle through smart technologies
Speed of delivery without accuracy is a dealbreaker for consumers. How can retailers operating in an omnichannel environment overcome the challenge of click-to-customer cycle times.
Story image
GapMaps Live to improve brand decisions on physical locations
GapMaps has released its latest service GapMaps Live, giving more insights and features to help brands make better decisions about physical locations.
Story image
Third-party automotive apps bear significant privacy risks
Mobile applications for connected cars provide various features to make life easier for motorists, but they can also be a source of risk.
Story image
What every CISO must answer to enable a best-in-class security operations program
It has been widely reported recently that South Australian government employees have been the victims of a cyberattack.
Story image
Digital Signage
MAXHUB's Digital Signage range to bolster boardroom productivity
The new MAXHUB Digital Signage technology is purpose-built to make every kind of team meeting more effective.
Connected e-commerce apps are the future of retail and higher revenue growth. Read the new ebook by Sift to find out how to maximise your business potential.
Link image
Story image
Top data and tech challenges for APAC banks - report
InterSystems’ new report finds that 87% of A/NZ banks experience frustrations and concerns in using their data to drive decision-making.
Story image
i-PRO releases smallest AI-based surveillance camera on the market
The new i-PRO mini network camera is now available, with a pocket-sized form factor and full AI analytics functionality.
Story image
BYOD / Bring Your Own Device
How zero trust can lead the battle against ransomware
SecOps teams champion a zero trust strategy to support the fight against the escalating risk of cybercrime and help monitor threat actors across a network.
Story image
Digital Transformation
Digital transformation increasing business complexities
A new survey suggests businesses must re-examine their digital transformation approach to better help employees adapt to change.
Story image
Data Protection
Information management capabilities to meet privacy requirements
Organisations with customers or operations across more than one country face a spate of new and proposed privacy and data protection laws.
Story image
SoftIron named global leader for efficient DC infrastructure solutions
SoftIron has been named a global leader for supplying energy-efficient data infrastructure solutions for core-to-edge data centers after an assessment by Earth Capital Ltd.
Story image
Microsoft, Cloudian partnership offers data center flexibility
Cloudian’s HyperStore object storage platform is now integrated and validated to work with Microsoft SQ Server 2022, offering more flexible and scalable data centers.