Ask any product security leader what's wrong with their application security testing and you'll hear the same answer: too many false positives. Look closely at those findings, though, and a different picture emerges: the findings themselves are technically true, but their actual impact, severity, or relevance is largely false. The tools found exactly what they were built to find: real vulnerabilities in code, infrastructure and design.
What the team couldn't do was “simply” fix them. The session timeout is longer than policy because an assisted-banking journey needs it. The amount field accepts negative values because reversals post that way. The upload endpoint accepts several file types because new customers must upload scanned identity documents to open an account. Each finding got marked accepted, exempt, approved, business-justified or waived. And because nobody was going to fix it, it got filed as a false positive.
Those findings aren't false positives. They're benign positives, the necessary evil every real product carries. In an AI-native SDLC, agents write and fix more of the code every month, and agentic security testing (AST) feeds findings straight back to them. That makes the difference impossible to ignore.
False positive vs. benign positive: correct detection, wrong label
So what is a benign positive? Microsoft implemented this in their ops flow already. Essentially, when an analyst closes an incident in Microsoft Sentinel, one of the classifications on offer is Benign Positive: the detection worked, and the activity turned out to be expected. Product security hasn’t borrowed the term, yet. This means we are still stuck with only 2 main bins:
- A false positive means the detection was wrong. The risk the rule protects against doesn't exist in this context, like a missing anti-forgery (CSRF) token on an API that doesn't use browser cookies, so that attack can't happen there.
- A true positive means the detection was right and the behavior is a defect.
A benign positive sits between them. The detection was right, the risk is real, and the business needs the behavior anyway. The test fits in two sentences. If the risk doesn't exist here, it's a false positive. If the risk exists but the business needs the behavior, it's a benign positive.
What gets lost when everything is a false positive
Filing a benign positive as a false positive feels harmless. The finding wasn't going to be fixed either way. But the label does three kinds of damage:
- The risk disappears. A false positive has no owner, no expiry date and no compensating control, because on paper there's nothing to compensate for. The long session is still open on the assisted-banking route, and nothing in the backlog says so anymore.
- The tool gets blamed for being right. Take a scanner that correctly flags 1,000 gaps, 800 of which the business keeps on purpose. It gets reported as 80% noise, as if only 20% of its findings were real. Teams learn to tune out correct detections, and the findings that genuinely need fixing have to fight through that skepticism. We covered what that does to developers in the Cutting Through ProdSec Noise blog.
- Someone eventually fixes one anyway. A new engineer, an audit push or a cleanup sprint closes the "easy" finding. The timeout drops to 15 minutes and older customers get logged out mid-transfer. The reversal endpoint starts rejecting negative amounts. Security loses credibility with the product team over a finding that was never a bug.
Why the AI-native SDLC makes benign positives impossible to ignore
Benign positives used to be a reporting problem. AI agents turn them into an engineering problem, and a far more visible one.
Route findings from agentic security testing straight back to a fix agent and it does what it was built to do: make the rule stop firing. It can't tell a benign positive from a defect, because the reason the behavior exists isn't in the code. So it either "fixes" the behavior and breaks a business flow, or a human rejects the change and the same finding returns on the next scan and the next pull request. Neither outcome looks like security working.
The same failure now happens before any finding exists. In vibe coding, security requirements reach the coding agent as instructions, and agents follow policy literally. Tell an agent that sessions expire after 15 minutes and it will apply that everywhere, including the one journey where the business approved 60. A rule a human would have applied with judgment now ships exactly as written, in every repository the agent touches.
How context-aware product security handles benign positives
A better label is only the start. What's missing is the context to decide what a correct finding should become. That context exists, but it's scattered.
It lives in design documents, product requirements and Jira tickets. It lives in the user flows and customer journeys the application supports, and in the business analysis behind them. It lives in security requirements, partner specifications, related source code in other services, and the memory of a few senior engineers. Only something that reads all of it can recognize a benign positive.
That's the approach we're taking at Prime. Before a correct finding turns into a ticket, Prime checks the finding against the code, the infrastructure, the user journeys and the business documents around it, using five questions. Was the deviation deliberate? Does a real business flow depend on it? Would the standard fix break current business logic? Is the deviation as narrow as the need? What limits the risk today?
The answers lead to one of four outcomes:
- Fix when the gap is a defect. An AI agent can do it only if the fix leaves business behavior unchanged.
- Narrow when the business needs the behavior in one place but it leaked everywhere. Keep it where it's needed and fix the rest.
- Compensate when the deviation can't shrink further. That means a scoped exception with an owner and an expiry, plus controls around it.
- Ask when the evidence doesn't settle it. One question goes to the product owner, in product terms, and the answer is reused.
Two rules sit underneath. First, benign positives go to the person who can decide what the product should do, usually a product or business owner, never straight to a fix agent.
Second, when a preventive control can't be put in place, fixed or narrowed, detective and corrective controls take over its job by design. Take the long session. If it can't be shortened, nothing stops an unattended session from being misused, so the goal becomes catching misuse fast. An alert fires when a transfer follows a long idle period, and the transfer is held until the customer confirms it. Detection and a quick response stand in for the block that couldn't be built.
None negotiable, or must-have list of controls, like encrypting card data and authenticating money movement, never gets an exception at all.
Five findings, five decisions
Let’s take a look at a few examples taken from an imaginary fintech. The first two come from cloud and data scanners, because benign positives aren't limited to code; the other three come from code.
The admin role the CNAPP flagged. A CNAPP tool correctly flags an IAM role with administrator rights that hasn't been used in months, and its standard fix is to remove it. Prime checks it against the approved design: it's the documented break-glass role for disaster recovery, owned by the platform team, so it's a benign positive, and removing it would leave no way in during an outage.
The public bucket the DSPM tool flagged. A DSPM tool correctly finds personal data in a public storage bucket but can't tell why it's there. Prime adds the context: if the business requires it by design, with the product manager who owns it, it's a benign positive; if not, it's a drift from the design to fix.
The 60-minute session. The standard says 15 minutes. The assisted-banking journey, where an older customer completes a transfer with a caregiver, needs longer. Prime narrows the deviation to that journey and keeps 15 minutes everywhere else. Around it go step-up authentication on transfers and new payees, a hard limit on total session length, and an alert when a sensitive action follows a long idle period.
The free-text field that can't be validated. Strict input validation would allowlist what a dispute note or payment memo may contain. But customers and investigators paste multilingual text, copied emails and evidence, so no allowlist fits. Prime compensates: limits on length and allowed characters stay, while the real protection moves to where the data is used. Queries are parameterized and output is encoded for its context. A content security policy backs that up, and injection patterns in those fields raise an alert.
The upload that accepts more than one file type. The scanner flags an endpoint that takes PDF, JPEG and TIFF files. New customers need all three to upload the identity documents required to open an account. Prime narrows the rule instead of dropping it: exactly those three types, checked by content rather than file extension. Uploads are virus-scanned, size-capped, stored outside the web root and re-rendered before anyone opens them.
What this means for product security leaders
Start with the pile you already have. Pull last quarter's false positives and sort them with the two-sentence test. If a large share turns out to be benign positives, two things are true at once. Your tools aren't as noisy as your metrics say, and your accepted risk is larger than your risk register says.
Then separate the two questions every finding raises. Whether a detection is correct is one field. What to do about it is another. Measure your tools on the first and run your program on the second.
Finally, keep benign positives away from automation until someone with authority has decided. An AI fix agent is a great tool for a missing parameterized query. It's the wrong tool for a behavior someone in the business chose on purpose. And whatever your coding agents are told to enforce should carry its exceptions with it.
From dismissal to decision
Calling a correct finding a false positive was always a shortcut. In an AI-native SDLC, where agents write and fix code at scale, it's a shortcut that breaks things. The detection was right. What was missing was the context to decide what the finding should become, and who should decide it.
At Prime, that context runs from the design before the code, through the code as it's written, to the system after it ships. It's what lets a benign positive become a scoped, owned decision instead of a quiet dismissal.
Ready to find out how many of your "false positives" are really benign positives? Learn more at primesec.ai.
