Which of the following is a potential risk of frequent false positives in an IDS?

• A. It increases analyst confidence in alerts
• B. It can desensitize operators due to frequent alerts
• C. It guarantees fewer misses
• D. It has no impact on incident response

Answer: (B)

Frequent false positives lead to alert fatigue. When an IDS generates many alerts that prove to be harmless, analysts start treating alerts as noise and may rush through or ignore them. This desensitization makes it more likely that real threats are overlooked or that responses are delayed, undermining the effectiveness of your monitoring and incident response. The other statements don’t fit: false positives don’t boost analyst confidence, they don’t guarantee fewer misses, and they certainly affect incident response by creating noise and reducing trust in alerts.