What is a false negative?
A false negative is a detection error in which a security tool reports nothing even though a real problem exists. The vulnerability scan comes back clean while a server is exploitable, the IDS stays quiet during an intrusion, or the antivirus lets a malicious file run. It is the most dangerous detection outcome, because it looks exactly like a clean result. Silence prompts no investigation, so a false negative usually comes to light later, through a breach, a threat hunt, a penetration test or a call from someone outside the organization.
Where false negatives come from
- Coverage gaps: hosts that were offline during the scan, subnets missing from the scope, unmanaged devices and log sources that were never connected to the SIEM.
- Limited visibility: non-credentialed scans cannot see client software that never opens a port, and network sensors cannot read encrypted payloads without TLS inspection.
- Missing detection content: no signature or scanner check exists yet for a zero-day, or a known piece of malware was recompiled so its hash no longer matches.
- Evasion: attackers fragment or re-encode traffic, use legitimate admin tools (living off the land) or move slowly to stay under thresholds.
- Over-tuning: a noisy rule was disabled, a threshold was raised too far or an exclusion covers too much.
- Poisoned baselines: an attacker who was active while an anomaly detector was learning becomes part of normal.
Example: two silent misses
After a routine update, the EDR agent on a file server crashes and never restarts. The console marks the host as last seen nine days ago, but nobody watches that column, and for those nine days an intruder's activity on the server produces no telemetry and no alerts. An alert on agents that stop checking in would have exposed the gap.
In another case, an EDR exclusion was added for the folder /opt/backup because backup jobs kept triggering ransomware-behavior alerts. An intruder who gains a shell copies tools into that folder and runs them from there. The exclusion fixed the noise by creating a blind spot, which is why exclusions should name specific processes and paths, carry an expiry date and be reviewed.
How to reduce false negatives
- Layer detection: network, endpoint, identity and cloud sensors each catch what the others miss.
- Use credentialed and agent-based scans, and build scan scope from the asset inventory and IP address management.
- Keep signatures and scanner plugins current, and watch the health of every log source and agent.
- Test detections on purpose: purple team exercises and attack simulations mapped to MITRE ATT&CK show whether an alert really fires.
- Hunt for threats on the assumption that something has already been missed.
False negative vs. false positive
The two errors trade off against each other. Lower a threshold and the tool catches more real attacks but raises more false alarms; raise it and the noise drops while more attacks slip through. False positives cost time and attention, and false negatives cost the breach itself, so organizations usually accept more false positives on their most critical assets. Good tuning removes known benign causes precisely instead of making a rule less sensitive overall.
False negative on the CompTIA Security+ exam
False negatives appear in SY0-801 objective 4.3, where scan results are validated and gaps in coverage matter, and in objective 4.4, where alerting rules are tuned. Wording such as a breach used a weakness that never appeared in scan results or the intrusion generated no alerts describes a false negative. The fixes the exam favors are credentialed or agent-based scanning, broader scope, updated signatures and careful tuning. Watch for the trap in which disabling a noisy rule is offered as the answer: it removes false positives by creating false negatives. Distractors include false positive, true negative and true positive.