False negative
A false negative is a real threat that a detection system fails to flag. It is the more expensive of the two errors, because nobody is looking at the thing that did not fire.
In security, a false negative is what happens when a detection system or security tool fails to identify a threat that is genuinely there.
Something malicious happens, it should have been caught, and nothing fires.
Understanding false negatives is how defences get better, because they are the gaps that nobody is currently looking at.
What characterises them
The threat goes unseen. Real activity gets past the tooling, usually because of limits in the signatures, because the behaviour does not match a known pattern, or because the attacker deliberately evaded detection.
Nothing gets done about it. If nothing is recognised, nothing is contained. The attack persists, and the integrity, confidentiality or availability of the systems stays compromised for as long as it lasts.
They distort how well you think you are doing. A high false negative rate produces quiet dashboards, and a quiet dashboard reads as safety when it means the opposite.
A worked example
An organisation uses an intrusion detection system to spot malicious activity on its network.
The IDS is designed to recognise traffic patterns associated with known attacks.
Because the signatures have not been updated, it does not recognise a new family of malware that has reached the network.
The malware operates unimpeded and starts exfiltrating data.
Since the IDS never raises an alert, nobody moves to contain or remove it. That is a false negative: the tool was working exactly as configured, and the configuration was the problem.
Why they are hard to manage
Threats keep moving. Tooling has to be updated continuously to recognise new malware variants and new techniques, and detection that is not maintained decays quietly.
Complex environments hide them. With many layers of security and a large volume of events, a false negative looks exactly like a quiet day. Alert overload makes it worse: genuine threats get missed inside the noise.
The practical way to find them is not to wait for them. Adversary emulation, purple team work and retesting exist precisely to generate activity that should fire, and then check whether it did.