False Positive

Establish a process to create high quality alerts and measure their quality, so analysts prioritise real incidents rather than spending time on false positives.

Use data analytics to detect fraud in proportion to the organization's data and risk: matching and exception tests across payroll, supplier, customer and payment data (duplicate payees, staff who are also suppliers, shared addresses or bank accounts), statisti...

Safety is the property of a system that, under defined conditions, keeps it from reaching a state that endangers human life, health, well-being, property or the environment, and AI can bring new safety problems (ISO/IEC 23894 A.10).

CSF 2.0 outcome: incidents are declared when adverse events meet the defined incident criteria. Priority High. R1: apply the incident criteria to the known and assumed characteristics of the analyzed activity, taking known false positives into account, to deci...

Deploying a data loss prevention tool on outgoing email must be fully justified to balance the employer's interest with employees' rights, because false positives expose legitimate and personal messages.

The organisation implements signature-based and, or, non-signature-based malicious code protection at entry and exit points, updates it automatically under configuration management, configures periodic scans at a set frequency and real-time scans of external f...