Turn triage outcomes into false-positive rate, precision, recall and F1, plus the hours and money spent chasing noise.
Precision and false-positive rate are complements of the same quantity — reporting both makes the trade-off obvious when someone proposes loosening detection to find more. Recall needs an external truth source, so the false-negative count has to come from penetration tests, a second scanner or bug bounty reports; without it, a quiet scanner looks perfect. A scanner with a 40% false-positive rate does not just waste time — it trains your engineers to dismiss findings, which is how the one real critical in the batch gets closed unread.
Scanner False Positive Rate
False positive rate = FP ÷ (TP + FP); precision = TP ÷ (TP + FP); recall = TP ÷ (TP + FN); F1 = 2 × precision × recall ÷ (precision + recall).
Cost of noise
Wasted hours = FP × triage minutes ÷ 60, and the annualised cost multiplies one cycle's waste by twelve.
False positive rate = FP ÷ (TP + FP); precision = TP ÷ (TP + FP); recall = TP ÷ (TP + FN); F1 = 2 × precision × recall ÷ (precision + recall). Precision and false-positive rate are complements of the same quantity — reporting both makes the trade-off obvious when someone proposes loosening detection to find more. Recall needs an external truth source, so the false-negative count has to come from penetration tests, a second scanner or bug bounty reports; without it, a quiet scanner looks perfect.
A scanner with a 40% false-positive rate does not just waste time — it trains your engineers to dismiss findings, which is how the one real critical in the batch gets closed unread.
This calculator takes 5 inputs: Confirmed true positives, Confirmed false positives, Known findings the scanner missed, Triage time per finding, Analyst cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Not if it was bought with recall. A scanner tuned to report only what it can prove will miss authenticated-only and configuration findings entirely. F1 is the figure to trend, because it punishes both failure modes.
Suppress by rule, not by finding, and give every suppression an owner, a reason and an expiry date. Unexpiring suppressions become invisible risk acceptances, and they are the first thing worth auditing when coverage looks suspiciously clean.