Derived from MITRE ATT&CK Enterprise

MITRE ATT&CK Coverage Map

Rate detection coverage across the fourteen enterprise tactics and see where an attacker would move unobserved.

All templates

When a detection programme needs an honest heat map before the next investment round.

What you need and what you get

You'll need

A view of detection and response capability per tactic
Coverage calls from none to strong

You'll get

A coverage map across the kill chain, downloadable as PNG or PowerPoint
A covered-tactics verdict with the gap that matters most
An Excel register carrying exactly what the diagram shows

MITRE ATT&CK Enterprise: coverage across the fourteen tactics

The fourteen enterprise tactics in kill chain order, from Reconnaissance to Impact, read down the left column and on down the right. Each card shows your declared detection coverage at one of four levels.

Rate detection coverage for every tactic: None, Partial, Good or Strong. Tactics at Good or Strong take the red tint; the summary line counts them, and the gaps left white are the places an intrusion would move unseen.

Rate each tactic and the map fills in as you go. The share of the kill chain at Good or Strong appears here with the next move.