4 ms·
The value of a scanner with this kind of s/n ratio is very low. Because it would still cost me a lot time (thus money) to investigate every alert every time. Wh
by aequitas 6y ago
The value of a scanner with this kind of s/n ratio is very low. Because it would still cost me a lot time (thus money) to investigate every alert every time. What I would pay for is a scanner that is contextually aware and alerts when needed, give or take a few false positives. Not ones that have false positive as their default.
- WrtCdEvrydy 6y agoNow you're getting it. Now think about the fact that most auditors want you running a scanner on your network (and it's required for certain legislation like GDPR)
- px43 6y agoSounds like what you're looking for is a scanner with more false negatives than false positives. One that won't alert you about a certain percentage of actual critical issues that it detects. You're not alone here, which is why things are so insecure. Enterprise security tools care mostly about catering to people like you who can't be bothered to investigate security issues. There are a totally different set of tools for those of us who actually want to find bugs, and the false positive rate (false:true ratio) on the best of those tools is more like 100:1. Often those tools have false positive rates of 1000:1 or even 10000:1, and people have built good machine learning models to sift through the findings automatically and sort them by likelihood of exploitability. It blows me away to hear people complain about the existence of false positives at ratios like 1:1. If only 50% of the findings in your tool are false positives, you are absolutely missing a ton of real bugs that will eventually be found by people who get paid to find real bugs.