While I can see what you're saying, you also have to properly compute, on your end, a cost for a False Positive and a cost for a False Negative. In my opinion,

While I can see what you're saying, you also have to properly compute, on your end, a cost for a False Positive and a cost for a False Negative. In my opinion, in the case of security, I think a False Negative should weigh a lot, and thus measures to prevent it should be in place (i.e. not having an intern mindlessly looking through issues and sorting them into buckets). Of course, the cost of each will depend on your app/company, its industry, its size, and so on.