Maybe it is a benefit of working in the IT Industry including security that I look at any report first as a false positive until proven otherwise. Reports are scrutinized of course but we never take action until we confirm the finding. I can see why others outside the field or relevant experience would look at it the exact opposite as if the tool is gospel —that is rarely the case. All software is suspect and subject to a “reasonableness test”.
Tom NY4I
Tom Schaefer - NY4I