False negatives

Last updated: Sep 30, 2026

---

Definition

A false negative (FN) is an incorrect report that says that there is no vulnerability or that it is missing.

Fluid Attacks considers a report a false negative with two conditions. Fluid Attacks did not report a vulnerability that was in the scope of its tests. And all the necessary inputs to reproduce the vulnerability were available.

False negatives are an important problem in software development projects. Overlooked issues can be part of leaks or successful cyberattacks.

False negative reporting process

In the Advanced plan

The Fluid Attacks solution has very low false negative rates. It tests the systems fully with many techniques.

But during Advanced, your organization or a different application security provider can find a vulnerability that Fluid Attacks did not flag. The software was in a previous assessment. This is a possible false negative. Subscribers to the Essential and the Advanced plans can send false negative requests. The two parties shall follow this protocol:

1. Send the FN request to your Fluid Attacks Engagement Manager or Sales Representative. Use one of the communication channels of your usual interactions.
2. Fluid Attacks shall classify the urgency of your request. If there is active exploitation of the vulnerability, the urgency is high. If the urgency is high, Fluid Attacks shall help you first to contain the incident.
3. The Engagement Manager shall give you the "False Negative Request" form.
4. Complete the form. Send it to Fluid Attacks. If a different application security provider reported the FN, send Fluid Attacks the full report from that provider. If the report is not one file, send the complete set of results or findings from that provider. (Ideally, upload the report to the platform, in the file set of the group that has the affected software in its scope.)
5. Fluid Attacks assigns a security analyst to do a full investigation of the report.
6. The analyst tries to reproduce the vulnerability in a controlled environment. If it is reproducible, the analyst tries to map the vulnerability to the codebase. The analyst then classifies the report as a false negative or not.
7. Fluid Attacks communicates the investigation results in a video call.

Accuracy SLA

A missed vulnerability confirmed through the protocol above does not count as a false negative for the Accuracy SLA if one of these conditions applies:

• The group has only the Essential plan.

• Fluid Attacks did not have the source code or the related environment.

• The environment had no pairing with the given branch.

• The environment was not stable for a minimum of 80% of the business days because of unsolved events.

• The data necessary for the continuous testing flows (for example, credentials or input fields) was not complete or unusable.

• Login or access needs client intervention on each sign-in (for example, OTPs that only the client receives).

• The vulnerability was there before Fluid Attacks added the repository to its tests. Also, there was no Health Check, or the post-Health Check review period was not complete.

• The status of the vulnerability changed from "Open" to "Closed" because of exclusions, deactivations, or removals.

• The average monthly insertions for each author exceed 8,000. The window is a rolling two-year period that ends on the date of the FN request.

  The average monthly insertions are the total number of insertions by all the authors of the client. Divide this total by the total number of active months accumulated across those authors.

• The report of the possible vulnerability arrived in the tolerable window of 90 calendar days after its injection date. The injection date is the date of the commit to the branch registered for tests in the platform. For SCA vulnerabilities, the vulnerability counts as a false negative only if a minimum of 48 hours passed since the publication of the CVE. The publication can be in one of the sources that Fluid Attacks consults, as defined in "Vulnerability signature update".

• The vulnerability is in an unsupported technology.

• The vulnerability is in an application that the client does not own or does not have the approval to send for tests.

When none of these conditions apply, a missed vulnerability is a confirmed false negative that affects the Accuracy SLA. Then, Fluid Attacks had access to the code and the environment. The vulnerability was there during the testing period. And Fluid Attacks did not identify it.