MITRE ATT&CK Coverage Assessment
Map your current detections to MITRE ATT&CK Enterprise, find your highest-risk gaps, and get a prioritised remediation roadmap.
- Covers all 14 ATT&CK Enterprise tactics (v15)
- Computes coverage percentage per tactic and overall
- Ranks gaps by exploitation frequency in the wild
- Exports a coverage heatmap PDF for board reporting
MITRE coverage snapshot
Example result based on typical mid-market SOC inputs
58% coverage
42 technique gaps identified across 12 tactics
Defense Evasion
Highest-risk gap (30 uncovered)
How this tool works
Select the tactics you detect for
Check off the 14 MITRE ATT&CK tactics your current detection rules address. Be honest — only check if you have active, tested rules in production.
Estimate techniques per tactic
For each checked tactic, estimate how many individual techniques you have detection coverage for. We compare against the ATT&CK technique count per tactic.
Receive your coverage score and gap report
The tool computes your percentage coverage, identifies your highest-risk gaps by tactic, and generates a prioritised remediation roadmap.
What to do with the result
Prioritise your gaps
The gap report ranks uncovered techniques by exploitation frequency in the wild, so you address the highest-risk blind spots first.
Share with stakeholders
Export the coverage heatmap as a PDF for CISO and board reporting. It maps directly to NIST CSF DE.CM controls.
Rerun after every deployment
Bookmark this page and rerun the assessment after each detection engineering sprint to track coverage improvement over time.
MITRE coverage assessment: frequently asked questions
What version of MITRE ATT&CK does this assessment use?
The assessment uses ATT&CK Enterprise v15 technique counts. Sub-techniques are grouped under their parent technique for scoring purposes. The tool is updated within 30 days of each ATT&CK release.
How is the coverage percentage calculated?
Coverage equals the number of ATT&CK techniques with at least one active detection rule divided by the total technique count in the selected scope. Sub-techniques each count separately.
Should I include detection-only rules or also response rules?
Include all detection rules that would generate an alert for the relevant technique. Response playbooks are not counted — coverage is about your ability to detect, not respond.
58% coverage sounds low — is that typical?
For organizations without a dedicated detection engineering function, 40-65% coverage is common. Top-quartile detection engineering teams achieve 75-85%. 100% coverage is a moving target as ATT&CK adds new techniques each release.
How does ManySignal's in-platform coverage map differ from this assessment?
This free tool is a manual self-evaluation. ManySignal's in-platform coverage map automatically maps your active and staged rules to ATT&CK techniques in real time, updates as rules are added or disabled, and shows coverage density (one rule vs. multiple overlapping rules).
Which tactics have the most critical blind spots for enterprise environments?
Defense Evasion (TA0005) has the most techniques and is chronically under-covered. Credential Access (TA0006) and Persistence (TA0003) are also high-risk with many organisations covering fewer than half the relevant techniques.
Can I import my existing rules to auto-populate the assessment?
The free version is manual. ManySignal's platform auto-imports rules from Splunk, Elastic, Sentinel, and Sigma-formatted sources and maps them to ATT&CK automatically. Book a demo to see this in action.
How do I prioritise which gaps to fix first?
Filter the gap report by 'High exploitation frequency' to see which uncovered techniques are actively used in ransomware and APT campaigns tracked in the last 90 days. Start there.
Does the assessment cover ICS/OT ATT&CK or only Enterprise?
The free tool covers ATT&CK Enterprise only. ATT&CK for ICS is a separate matrix. Contact ManySignal if you need OT/ICS coverage assessment guidance.
Close your ATT&CK gaps with 1,247 production-ready detections
ManySignal ships detections mapped to ATT&CK. Book a demo to see your real coverage map built from your actual sources.