Overview
Before reporting, findings should be validated — confirmed as genuine and reproducible, with false positives removed. This lesson covers validating findings in an assessment.
Learning objectives
- Explain why validation is necessary.
- Describe distinguishing true findings from false positives.
- Connect validation to report quality and trust.
Core concept
Validation is confirming that each finding is a real, reproducible vulnerability rather than a false positive or a misinterpretation. It means reproducing the issue from its evidence, confirming the impact is genuine, and ruling out benign explanations. Automated tools and quick observations can produce false positives, so a professional assessment validates findings — often manually — before including them in the report. Only validated findings, with confirmed impact, should be reported.
How it works
For each candidate finding, the tester re-tests it from a known state using the recorded reproduction steps, confirming the behavior is consistent and the impact real. Findings that cannot be reproduced, or that turn out to be expected behavior or tool artifacts, are discarded or downgraded. Validation may also refine the finding's details and severity based on confirmed impact. This step ensures the report contains accurate, trustworthy findings — critical because false positives waste remediation effort and erode confidence in the assessment.
Practical example
An automated scan flags a "possible SQL injection." Before reporting, the tester validates it: reproducing the request in a controlled way to confirm whether the input actually affects the query's behavior. If confirmed reproducible with real impact, it is reported (with evidence and severity); if it turns out to be a false positive (the input is safely parameterized and the tool misjudged), it is removed. Validation ensured the report reflects a real issue, not a scanner artifact.
Cybersecurity relevance
Validation is what separates a credible assessment from a noisy tool dump. False positives waste the owner's time, and unvalidated claims undermine trust in the whole report. Manual validation of automated results is standard professional practice. Validated findings — reproducible, with confirmed impact and justified severity — make remediation efficient and the assessment trustworthy. This step directly precedes reporting and later remediation verification, both of which depend on findings being real and reproducible.
Common mistakes
- Reporting unvalidated tool output, including false positives.
- Not reproducing findings to confirm they are real and consistent.
- Overstating impact without confirming it during validation.
Key takeaways
- Validation confirms each finding is a real, reproducible vulnerability, removing false positives and misinterpretations.
- Reproduce findings from their evidence, confirm genuine impact, and refine details/severity accordingly before reporting.
- Validation (especially of automated results) is standard professional practice; it ensures an accurate, trustworthy report and efficient remediation.
Check your understanding
- Why must findings — especially those from automated tools — be validated before reporting?
- What happens to a candidate finding that cannot be reproduced or turns out to be expected behavior?