Which term describes a vulnerability assessment result where the test reports no issues, but exploitable vulnerabilities exist?

Which term describes a vulnerability assessment result where the test reports no issues, but exploitable vulnerabilities exist?

• A. False negatives
• B. True negatives
• C. True positives
• D. False positives

Answer: (A)

Understanding false negatives in vulnerability assessments: When a scan reports no issues but exploitable vulnerabilities exist, the test has failed to detect real problems. This is a false negative—the vulnerability is present, but the tool or process didn’t flag it. The risk is that you assume the system is secure when it isn’t, leaving exploitable flaws unchecked. By contrast, a true negative would be no vulnerabilities and the scan correctly reports none; a true positive would be detecting a vulnerability that exists; a false positive would be reporting a vulnerability that doesn’t actually exist.

Understanding false negatives in vulnerability assessments: When a scan reports no issues but exploitable vulnerabilities exist, the test has failed to detect real problems. This is a false negative—the vulnerability is present, but the tool or process didn’t flag it. The risk is that you assume the system is secure when it isn’t, leaving exploitable flaws unchecked. By contrast, a true negative would be no vulnerabilities and the scan correctly reports none; a true positive would be detecting a vulnerability that exists; a false positive would be reporting a vulnerability that doesn’t actually exist.