False negative (security testing)
A false negative in security testing is a result that reports no issue when an issue is in fact present.
False negatives are more damaging than false positives. A false positive costs an analyst an hour; a false negative ships, and the report that missed it is later used as evidence that the application was assessed.
In mobile testing the dominant structural cause is environmental: the application detected the test environment and changed behaviour. The finding was not missed by the analysis — it was never presented to it.
Related terms
- Emulator detection — Emulator detection is the set of runtime checks an application performs to determine whether it is running on virtualised hardware rather than a physical handset.
- OWASP MASVS — The OWASP Mobile Application Security Verification Standard is a framework that defines what a mobile application must satisfy to be considered secure, organised into control groups covering storage, cryptography, authentication, network, platform interaction, code quality and resilience.