There is provided a mask inspection system and a method of mask inspection. The method comprises: detecting, by the inspection tool, a runtime defect at a defect location on a mask of a semiconductor specimen during runtime scan of the mask, and acquiring, by the inspection tool after runtime and based on the defect location, a plurality sets of aerial images of the runtime defect corresponding to a plurality of focus states throughout a focus process window, each set of aerial images acquired at a respective focus state. The method further comprises for each set of aerial images, calculating a statistic-based EPD value of the runtime defect, thereby giving rise to a plurality of statistic-based EPD values each corresponding to a respective focus state, and determining whether the runtime defect is a true defect based on the plurality of statistic-based EPD values.