Scanner False Positive Rate Calculator

False positive rate = FP ÷ (TP + FP); precision = TP ÷ (TP + FP); recall = TP ÷ (TP + FN); F1 = 2 × precision × recall ÷ (precision + recall). Precision and false-positive rate are complements of the same quantity — reporting both makes the trade-off obvious when someone proposes loosening detection to find more. Recall needs an external truth source, so the false-negative count has to come from penetration tests, a second scanner or bug bounty reports; without it, a quiet scanner looks perfect.

A scanner with a 40% false-positive rate does not just waste time — it trains your engineers to dismiss findings, which is how the one real critical in the batch gets closed unread.

This calculator takes 5 inputs: Confirmed true positives, Confirmed false positives, Known findings the scanner missed, Triage time per finding, Analyst cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Not if it was bought with recall. A scanner tuned to report only what it can prove will miss authenticated-only and configuration findings entirely. F1 is the figure to trend, because it punishes both failure modes.

Suppress by rule, not by finding, and give every suppression an owner, a reason and an expiry date. Unexpiring suppressions become invisible risk acceptances, and they are the first thing worth auditing when coverage looks suspiciously clean.