Reducing False Positives in Vulnerability Detection: A Survey of LLM-Based and Agentic Approaches

Security teams face overwhelming false positive rates: traditional SAST tools produce 68–95% false positives, SOC analysts routinely leave the majority of alerts uninvestigated, and analyst burnout is pervasive. This survey analyzes 100 sources (academic papers, vendor data, production case studies) covering 10 distinct AI/LLM-based approaches to false positive reduction in security tooling. We find that no single approach dominates: hybrid SAST+LLM pipelines eliminate 94–98% of false positives in one industrial study on reliability bugs (null pointer, out-of-bounds, divide-by-zero; transferability to security-specific SAST is not yet established); triage memories offer fast ROI (2 memories, 2.8× improvement in one vendor case study); and proof-of-concept validation achieves zero false positives by confirming exploitability. Benchmark-to-production gaps vary by model: in one study (n=58), Gemini-2.5-pro drops from F1=0.910 on a synthetic benchmark to F1=0.372 on real-world code, while GPT-5 achieves F1=0.955 with precision=1.0 on the same real-world dataset, suggesting the gap is model-specific rather than universal. Production systems that report the best results combine 2–3 methods, though no controlled study has compared combined vs. single-approach effectiveness. We categorize approaches along three axes (when applied, what it needs, guarantee type), compare cost-effectiveness, and identify seven open problems including benchmark decontamination, dataset quality (35–61% of vulnerability labels are incorrect), and business logic vulnerability detection.