The remediation team reports that most of its time is spent investigating vulnerability scan findings that turn out not to be real, while confirmed critical issues wait in the queue. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
A smoke detector that shrieks every time you make toast trains you to ignore it. Tune it so the alarms mean something, and your people can get to the real fires. The trap is ripping it out entirely or telling the team to just stop listening.
Full Explanation
False positives consume remediation capacity and delay treatment of real exposures, so the process feeding the queue needs to be fixed. Tuning scanner policies, using authenticated scans where appropriate, suppressing validated false positives with documented justification and adding a validation step before findings enter the remediation queue all focus effort on confirmed risk. That restores the process's purpose: closing weaknesses that matter. Suspending scanning until a new tool arrives removes visibility of real vulnerabilities and assumes the tool rather than its configuration is the cause. Closing any finding not confirmed within a day as resolved discards potentially real exposures on an arbitrary timer and corrupts the vulnerability records. Reporting the false positive rate to the board as the headline metric misdirects governance attention to an operational tuning issue rather than risk reduction on critical assets. Exam caveat: suppressions must be reviewed periodically, because a finding that was a false positive on one configuration may become real after a change. Operational check: confirm the false positive rate and time-to-remediate for confirmed critical findings are tracked, that suppressions carry a reason and review date, and that the critical backlog is shrinking.