What is a false negative?¶

A false negative occurs when malicious or relevant activity happens but the security system does not identify it.

Avoid the dangerous assumption¶

The dangerous assumption is that the absence of an alert proves that no attack or compromise occurred.

Security tooling has limits.

Activity may be missed because the relevant logging was not enabled, the product did not monitor that system, the detection rule did not cover the method, an attacker used a legitimate tool, the activity was encrypted, the offender disabled or bypassed security controls, the event fell below a threshold, the records were lost before analysis or the product or sensor was not functioning.

A false negative may only become apparent after another source reveals the activity. For example, a cloud audit log may show access that the endpoint product did not detect, or a later forensic examination may identify execution artefacts that generated no alert.

Investigators should therefore avoid framing the enquiry solely around security alerts.

Ask what systems were monitored, which data sources were available, whether there were coverage gaps and whether the relevant rule existed and was enabled at the time.

The absence of an alert can still be evidence. It may help show that the activity did not meet a particular rule or was not visible to a particular product. It does not establish that the event did not happen.

Compare several independent sources where possible: endpoint records, authentication logs, network data, cloud audit logs, email records, application logs and witness accounts.

The purpose is not to prove that every product failed. It is to understand what each product could and could not see.

Operational takeaway¶

Treat the absence of an alert as a limitation of the available detection evidence, not as proof that the activity did not occur.