False positives are the bane of IT security products in general. I would say that 90% of issues reported are FPs and the end user is expected to figure that out, confirm then double confirm before reporting it as a potential issue.