What a false-positive workflow actually looks like.

Every scanner will produce findings you do not want. The bad programmes solve this with a deny-list that grows forever; the good ones solve it in layers, and record why each layer fired.

Layer one: collapse duplicates at ingest

The same misconfiguration found on forty hosts is one finding with forty assets. If your scanner emits one row per host, engineers will close thirty-nine of them and mark the fortieth as wontfix, which is how a real risk disappears into a cleanup.

Deduplicate on (check id, affected asset group, root cause signature) — not on the raw response. The grouping matters: a missing security header on every subdomain is one ticket, not two hundred.

Layer two: confirm before you report

Network-level checks are cheap and unreliable. A missing header reported on a page that is only ever served to an authenticated session is a false positive with a good excuse. Re-issue the request with the session context you actually hold, and only report what reproduces.

Layer three: let humans adjudicate the rest

Some findings can only be judged by someone who understands the application. That is not a scanner failure — it is the scanner telling you it needs help. The important thing is that the request for help is itself a tracked state with an owner, so un-adjudicated findings age visibly instead of rotting in a queue.

What good looks like in practice

• Critical and high findings reach a human before they reach a client — always.
• A finding suppressed in March reappears automatically in September if the condition still holds.
• The suppression ratio is reported per check, so a noisy check gets fixed or disabled rather than silently ignored.
• Nobody on the security team can suppress a critical finding without it being visible to the tenant admin.

Noise is a symptom of an unowned problem. Track the suppression rate per check and you will find the two or three checks generating most of your noise — usually worth fixing in the scanner, usually not worth arguing about in a triage meeting.