Every finding a static-analysis (SAST) scanner emits gets a confidence score. The engineering question in a real secure-SDLC pipeline is never "is the scanner right?" — it is where to set the gate so triage capacity isn't drowned in noise while real vulnerabilities still get caught.
Precision = TP / (TP + FP) "of what we flagged, how much was real"
Recall = TP / (TP + FN) "of what was real, how much did we catch"
F1 = 2 · P·R / (P + R)
Each of the sample size findings above the strip is secretly a true vulnerability or a false positive, drawn according to the prevalence slider. True vulnerabilities carry a confidence score sampled from a distribution centered high (but overlapping); false positives from one centered low (also overlapping) — the messy separation real scanners produce. The vertical gate line sits at the threshold: a finding to the right of it is flagged for human review, to the left it is auto-dismissed.
- Raise the threshold — fewer false positives reach reviewers (precision ↑), but real vulnerabilities with lower confidence get silently dismissed (recall ↓).
- Lower the threshold — nearly everything gets reviewed (recall ↑), but the review queue fills with noise (precision ↓) — the "alert fatigue" failure mode that gets a CI security gate disabled by frustrated teams.
- Prevalence — the codebase's true vulnerability rate; a lower rate (common in mature code) makes even a good scanner's precision collapse at any fixed threshold — the base-rate effect at the heart of signal-detection theory.
The bottom chart traces the full precision-recall curve for the current sample — precision and recall recomputed at every possible threshold from 0% to 100% — with a live dot marking where the slider currently sits. This is the standard way security teams pick an operating point for a CI security gate, SIEM alert rule, or malware classifier.