Definition
Suppression hides or accepts a finding for workflow purposes. Disproval provides evidence that the finding is invalid in the evaluated context. The distinction prevents ignored findings from being misrepresented as proven false.
A suppressed finding remains a risk until disproven. A disproven finding has evidence showing it does not apply.
Why it matters
It prevents ignored findings from being misrepresented as proven false. Suppression without disproval is a common way risk is silently accepted.
Example
A SAST finding is marked "won't fix" with no evidence. That is suppression. A disproval would include reachability analysis showing the function is unreachable or a policy exception recording why the finding is invalid.
Related terms
- Evidence ladder — A governed sequence of evidence states that prevents raw signals from being treated as proof.
- Verified remediation — Confirmation, through qualified evidence, that a claimed fix removed or neutralized the specific risk being evaluated.
- Vulnerability fix proof — Independent evidence that a reported vulnerability no longer applies to the release candidate.