Sounds like what you're looking for is a scanner with more false negatives than false positives. One that won't alert you about a certain percentage of actual c

Sounds like what you're looking for is a scanner with more false negatives than false positives. One that won't alert you about a certain percentage of actual critical issues that it detects. You're not alone here, which is why things are so insecure. Enterprise security tools care mostly about catering to people like you who can't be bothered to investigate security issues. There are a totally different set of tools for those of us who actually want to find bugs, and the false positive rate (false:true ratio) on the best of those tools is more like 100:1. Often those tools have false positive rates of 1000:1 or even 10000:1, and people have built good machine learning models to sift through the findings automatically and sort them by likelihood of exploitability. It blows me away to hear people complain about the existence of false positives at ratios like 1:1. If only 50% of the findings in your tool are false positives, you are absolutely missing a ton of real bugs that will eventually be found by people who get paid to find real bugs.