The developers are more confident while fixing vulnerabilities due to the solution’s low false-positive rate.

False positives are rare. Veracode provides us with enough information about the issue, so we can usually identify them as we go through the report. We are also learning from the issues and from Veracode itself. If a false positive is reported, it is fine and does not have a significant impact on us.

We can add notes to any false positives during static analysis testing so that our developers can see the notes and avoid wasting time on them.