thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

False Negative (FN)

A failure to alert on activity that is actually malicious.

Definition

False negatives are the most dangerous detection outcome because attacks proceed unnoticed. They result from missing log sources, outdated signatures, evasion techniques or overly aggressive tuning. Threat hunting and purple teaming help find detection gaps.

Example

Ransomware encrypts a server without any alert because EDR was not installed there.

Exam tip

Over-tuning to reduce false positives can create false negatives.

Related terms