Coverage is not a percentage
What ATT&CK mapping tells you, what it does not, and how a coverage number becomes misleading.
The number everyone wants
Boards ask for it, insurers like it and vendors are happy to supply it: a single percentage describing how much of MITRE ATT&CK you cover.
It is a reasonable thing to want. It is also, taken at face value, close to meaningless, and understanding why is the difference between a coverage programme that improves security and one that improves reporting.
Problem one: every technique counts the same
A raw percentage treats a technique used by three state actors against your exact sector identically to one that has never been observed outside a research paper.
Adversaries do not distribute their effort evenly across the matrix, so a defender who does is optimising for the wrong thing. Two organisations with the same percentage can have completely different real exposure, and the one with the lower number is frequently better defended.
Problem two: claimed coverage is not demonstrated coverage
Most coverage maps are assembled from what products say they can detect. That is a statement about a product in a lab, not about your deployment, your log sources, your tuning or your exclusions.
The gap between the two is where incidents live. A detection that exists but was disabled during a noisy migration, or that depends on a log source that stopped shipping three months ago, appears on the map exactly like one that works.
What a useful map looks like
Three changes make the difference.
Weight it. Overlay the actors, campaigns and tooling actually active against your sector, geography and technology, and let that reorder the map. The gaps at the top should be the ones that matter to you.
Separate claimed from proven. A technique should only be marked covered when something has demonstrated it. Everything else is a hypothesis, and displaying hypotheses as facts is how boards end up surprised.
Show drift. Coverage decays. Log sources break, rules get disabled, estates change. A map that only ever goes up is not measuring anything.
The question worth asking instead
Not "what percentage do we cover" but "against the techniques an adversary would actually use on us, where are we covered, where are we blind, and how do we know".
That question is harder to answer and considerably more useful. It also has the pleasant property that answering it honestly tends to produce work worth doing, whereas optimising a percentage tends to produce detections for techniques nobody is using.
Questions, answered
Is ATT&CK mapping worth doing at all?
How do you prove coverage rather than claim it?
Where this goes next
Want this applied to your estate?
Tell us what you are protecting and where you feel exposed. We will map it to the right capabilities and set up a walkthrough.