This is why you should have several of them checking against the same rulesets and cross-check them to reduce chasing of false positives.