ATT&CK coverage & mapping

Coverage you can prove, technique by technique

Most organisations cannot answer a simple question: against the techniques an adversary would actually use on us, where are we covered, where are we blind, and how do we know? HexaMatrix answers it continuously. Every detection, control, test and OT signal on the platform carries ATT&CK technique tags, so coverage becomes a measured, evidenced map rather than an assumption.

Book a meeting See the platform

ATT&CK for Enterprise ATT&CK for ICS ATT&CK for Mobile ATLAS (AI) Maritime overlay

Why coverage

You think you're covered. Can you prove it?

Most teams describe their coverage in green traffic lights and vendor promises. HexaMatrix maps your actual detection and response coverage to MITRE ATT&CK, technique by technique, measured from real telemetry and testing, then weights it by the adversaries actually coming for your sector, so you close the gaps that matter first.

Assumed vs measured

A dashboard full of green is not coverage. HexaMatrix proves what you actually detect and stop, mapped to ATT&CK technique by technique.

Weighted for your threats

Not all techniques matter equally. Coverage is prioritised by the adversaries and TTPs actually targeting your sector, via HexaInt.

Gaps become work

Every gap turns into a prioritised action, and every action closed becomes defensible evidence in HexaComply.

Coverage, measured rather than assumed

Every detection HexaSOC runs, every control HexaComply evidences, every test HexaStrike executes and every signal HexaOT collects carries ATT&CK technique tags. HexaMatrix assembles them into one live map, so coverage stops being a slide and becomes a measurement.

One map across prevention, detection, response and validation
Technique-level detail, not tool-level marketing claims
Coverage marked validated only where a test has actually proved it
Drift surfaced the moment a log source or detection stops working

Four matrices, plus the one nobody publishes

HexaMatrix works across ATT&CK for Enterprise, ATT&CK for ICS, ATT&CK for Mobile and ATLAS, MITRE’s matrix for adversarial threats to AI systems. On top of those, we maintain a maritime overlay mapping bridge, engine-room, cargo and satellite communication systems onto the relevant techniques, because no official maritime matrix exists.

ATT&CK for Enterprise across IT, cloud and identity
ATT&CK for ICS across plant, grid, vessel and building systems
ATLAS for the AI systems you are starting to depend on
A maintained maritime overlay for fleet and terminal technology
One coverage model, so IT and OT are never scored separately

Weighted by who is actually coming for you

A raw coverage percentage treats every technique as equally important. Adversaries do not. HexaInt supplies the threat actors, campaigns and tooling currently active against your sector, geography and technology, and HexaMatrix reweights the map accordingly, so the gaps at the top of the list are the ones that matter to you.

Threat profiling from live HexaInt intelligence, refreshed continuously
Sector and geography weighting rather than a generic global average
Newly published techniques reflected in days, not at the next review
A prioritised gap list your engineers can actually work through

Gaps become work, and work becomes evidence

A gap that sits in a report is not a control. HexaMatrix turns weighted gaps into detection engineering tasks for HexaSOC and validation targets for HexaStrike. When a new detection ships, the technique is re-tested and the map updates from evidence rather than from someone closing a ticket.

Weighted gaps raised as engineering work, not as a PDF
HexaStrike validates the fix before coverage is marked proven
Board and regulator reporting drawn from the same live map
Evidence flows straight into HexaComply for NIST CSF, IEC 62443 and CAF

FAQ

Questions, answered

What is MITRE ATT&CK and why map to it?

MITRE ATT&CK is a public knowledge base of the tactics and techniques adversaries actually use, observed in real intrusions. Mapping to it turns security from a list of products into a coverage question: for each technique an adversary might use against you, can you prevent it, detect it, respond to it, and evidence that you can? It is the closest the industry has to a shared language for describing what a security programme actually covers.

Which matrices does HexaMatrix cover?

ATT&CK for Enterprise, ATT&CK for ICS, ATT&CK for Mobile and ATLAS, MITRE's companion matrix for adversarial threats to AI systems. On top of those, HexaShield maintains a maritime overlay that maps vessel and terminal technology, bridge and engine-room systems and satellite communications onto the relevant Enterprise and ICS techniques, because no official MITRE maritime matrix exists.

How is this different from a vendor coverage chart?

A vendor coverage chart tells you what a product could theoretically detect. HexaMatrix tells you what your environment demonstrably does detect. Coverage claims are backed by live detection health from HexaSOC and by validation from HexaStrike, so a technique is only marked covered when something has actually proved it. Untested coverage is shown as exactly that.

What does 'weighted by threat profile' mean?

A raw coverage percentage treats every technique as equally important, which no adversary does. HexaInt supplies the threat actors, campaigns and tooling currently active against your sector, geography and technology stack, and HexaMatrix weights your coverage map accordingly. The result is a prioritised view: the gaps that matter to you, not the gaps that matter in general.

Do gaps turn into work automatically?

Yes, and that is the point of running it inside a single platform. A weighted gap becomes a detection-engineering task for HexaSOC and, where appropriate, a validation target for HexaStrike. Once a new detection ships, HexaStrike re-tests the technique and the map updates from evidence rather than from a ticket being closed.

Does HexaMatrix help with compliance frameworks?

Indirectly but usefully. Frameworks such as NIST CSF 2.0, IEC 62443 and the NCSC CAF ask you to demonstrate detection and response capability rather than list tools. An evidenced ATT&CK coverage map is unusually strong support for those control objectives, and HexaComply consumes it as evidence automatically.

See your coverage map, weighted for you

We will map your current detections and controls to ATT&CK, overlay the threat actors active in your sector, and show you the gaps that matter.

Book a demo Explore HexaCore

Platform

Solutions

Industries

Partners

Learning

Company