False positives may be a nuisance in vulnerability testing, but false negatives are the ones you should worry about.