🔴
False positive: legitimate activity flagged as malicious. Causes alert fatigue.
🔵
False negative: malicious activity not detected. More dangerous — missed attack.
Tuning IDS/IPS reduces false positives. Too sensitive = false positives. Too lenient = false negatives. Both are bad — balance is key. False negatives are more dangerous (undetected attacks).