When an activity is correctly identified as malware, it is known as a True Positive. When an activity is correctly identified as a normal activity, it is known as a True Negative. There is no impact on normal, legitimate users, and the activity of threat actors is halted.