A true-positive vulnerability is a security finding that has been verified as real. It is not a false alarm, a duplicate, or a pattern match that only looks risky. Security tools, code reviewers, and penetration testers use this label after checking evidence such as reachable code paths, exploitability, or a reproducible proof of concept.
This matters because triage is a major bottleneck in cyber security. If teams waste time on false positives, they miss urgent bugs and slow remediation. In source-code review, for example, an AI system may flag many suspicious functions; only the confirmed issues count as true positives. Attackers also care about this distinction, because confirmed weaknesses are the ones worth targeting. Defenders rely on true-positive validation to prioritize patching, reduce noise, and justify response actions with evidence rather than guesses.