False Negative Comfort
False Negative Comfort (n.) The dangerous assumption that absence of alerts means absence of problems.
Explanation
No alerts fired today. The team relaxes. But the absence of alerts might mean the detection system is broken, the thresholds are wrong, or the attacker is operating below the radar.
Operational Example
A fraud team celebrates a quiet month — zero alerts. Investigation reveals the detection model was silently failing for 3 weeks due to a data pipeline change. Fraud was happening. Detection was not.
Why It Matters
False negative comfort is more dangerous than false positive fatigue. At least false positives prove the system is watching.
What Most Teams Get Wrong
They treat quiet periods as success instead of investigating why it is quiet.
What Strong Teams Do Differently
Monitor for expected alert volume. If alerts drop below baseline, investigate immediately. Silence is suspicious.