38 ms·
So how much is involved in writing the rules, and at the end of it, what is the net false positive?
by wglb 7y ago
So how much is involved in writing the rules, and at the end of it, what is the net false positive?
- tru3_power 7y agoIt took me a few months to get decent results with a low false positive rate. We haven’t had the tooling in place long enough to give hard stats but our aim is to have a false positive rate of less than 25%. Another great thing that these tools provide (if the results are valid) is that they let more junior members of the team/developers not as familiar with security issues to be able to understand the vulnerabilities found as they display a nice call flow graph/diagram that’s shows source to sink.