A true-positive is a security finding that is confirmed to be real, not a false alarm. In vulnerability scanning, malware detection, or threat hunting, tools often generate many alerts; only some represent actual weaknesses, malicious activity, or policy violations. Confirming a true-positive usually requires validation by an analyst, reproduction of the issue, or comparison with known indicators.
This distinction matters because security teams have limited time. False positives waste effort, while true-positives deserve immediate triage, containment, and remediation. In real attacks, automated tools may flag real vulnerabilities in exposed source code, leaked credentials, or suspicious network behavior; defenders use the same concept to prioritize what is genuinely actionable. A high count of true-positives can show that scanning or AI-assisted analysis is finding real problems quickly, which is valuable for defense but also dangerous if attackers are doing the same on stolen code or exposed systems.