4 ms·

The risk of failure to the scanner company is high. The risk of failure to you is low. That's the difference, they are shifting the burden of security to you.

The risk of failure to the scanner company is high. The risk of failure to you is low. That's the difference, they are shifting the burden of security to you... since if you don't patch the "exploit" which may not be an exploit, they can always point back to you in case there is a security breach because you didn't listen to the "magical scanner". It's a clear conflict of interest from twisted incentives. Additionally, if the thing never throws up any exploit warnings, you might wonder why you're paying so much for this fancy alerting thing.

aequitas 6y ago
The value of a scanner with this kind of s/n ratio is very low. Because it would still cost me a lot time (thus money) to investigate every alert every time. What I would pay for is a scanner that is contextually aware and alerts when needed, give or take a few false positives. Not ones that have false positive as their default.
- WrtCdEvrydy 6y ago
  Now you're getting it. Now think about the fact that most auditors want you running a scanner on your network (and it's required for certain legislation like GDPR)
- px43 6y ago
  Sounds like what you're looking for is a scanner with more false negatives than false positives. One that won't alert you about a certain percentage of actual critical issues that it detects. You're not alone here, which is why things are so insecure. Enterprise security tools care mostly about catering to people like you who can't be bothered to investigate security issues. There are a totally different set of tools for those of us who actually want to find bugs, and the false positive rate (false:true ratio) on the best of those tools is more like 100:1. Often those tools have false positive rates of 1000:1 or even 10000:1, and people have built good machine learning models to sift through the findings automatically and sort them by likelihood of exploitability. It blows me away to hear people complain about the existence of false positives at ratios like 1:1. If only 50% of the findings in your tool are false positives, you are absolutely missing a ton of real bugs that will eventually be found by people who get paid to find real bugs.

aequitas 6y ago

The value of a scanner with this kind of s/n ratio is very low. Because it would still cost me a lot time (thus money) to investigate every alert every time. What I would pay for is a scanner that is contextually aware and alerts when needed, give or take a few false positives. Not ones that have false positive as their default.

WrtCdEvrydy 6y ago
Now you're getting it. Now think about the fact that most auditors want you running a scanner on your network (and it's required for certain legislation like GDPR)
px43 6y ago
Sounds like what you're looking for is a scanner with more false negatives than false positives. One that won't alert you about a certain percentage of actual critical issues that it detects. You're not alone here, which is why things are so insecure. Enterprise security tools care mostly about catering to people like you who can't be bothered to investigate security issues. There are a totally different set of tools for those of us who actually want to find bugs, and the false positive rate (false:true ratio) on the best of those tools is more like 100:1. Often those tools have false positive rates of 1000:1 or even 10000:1, and people have built good machine learning models to sift through the findings automatically and sort them by likelihood of exploitability. It blows me away to hear people complain about the existence of false positives at ratios like 1:1. If only 50% of the findings in your tool are false positives, you are absolutely missing a ton of real bugs that will eventually be found by people who get paid to find real bugs.