# What is a False Negative?

> A false negative is a failure to detect or report a real threat — the dangerous counterpart of a false positive, because it produces silent misses rather than noise.

- Canonical URL: https://yellowcube.eu/glossary/false-negative/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A false negative occurs when a control, detection rule, model, or analyst concludes that malicious or policy-violating activity is benign or absent. Causes include coverage gaps, evasion, stale signatures, mis-scoped rules, encrypted traffic, log loss, and thresholds tuned to reduce noise.

### Key points

- **Miss-rate estimation:** Use purple-team testing, breach and attack simulation, retrospective hunts, and incident review to estimate miss rates that dashboards do not show.
- **Deliberate tuning:** Every threshold change trades false positives for false negatives; record who accepted that trade and why.
- **Important limitation:** Absence of alerts is not evidence of absence. Detection coverage can be estimated and tested but never proven complete.

### Related terms

[False positive](<https://yellowcube.eu/glossary/false-positive/>) · [Alert triage](<https://yellowcube.eu/glossary/alert-triage/>) · [Detection engineering](<https://yellowcube.eu/glossary/detection-engineering/>) · [Breach and attack simulation (BAS)](<https://yellowcube.eu/glossary/breach-and-attack-simulation/>) · [Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>)

### Sources

[MITRE ATT&CK](https://attack.mitre.org/) · [NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems](https://csrc.nist.gov/pubs/sp/800/94/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.