Definition
A true positive occurs when a security system correctly identifies a malicious or unwanted event as harmful. This means the system's detection mechanism accurately flagged a genuine threat, preventing potential damage or unauthorized access. In practice, a true positive triggers an alert or an automated response, such as blocking an IP address or quarantining a file. Understanding true positives is crucial for assessing the effectiveness of security controls and for tuning systems to minimize false alarms. For instance, an intrusion detection system flagging a known exploit attempt against a web server is a true positive. This differs from a false positive, where a legitimate activity is mistakenly identified as a threat. True positives are a key concept tested on exams like CompTIA Security+, CySA+, and CISSP.