Beyond the Heatmap: A New Way to Measure Detection Coverage

By Antonia Feffer • September 10, 2026

Ask a security team how much of MITRE ATT&CK they cover, and there is a good chance the answer involves a heatmap. Green means covered, red means not covered, and perhaps a few shades in between. It is easy to communicate and useful for understanding where detection content has been mapped, but what does “covered” actually mean?

If a detection rule carries an ATT&CK technique tag, does that mean it can reliably detect that technique? Does it detect every meaningful way the technique can be performed? Does the underlying telemetry provide enough information to distinguish malicious activity from normal activity? And how easily could an adversary change what they are doing and step around the detection?

These questions motivated the newest iteration of our Summiting the Pyramid (STP) research. Along with the expertise of our members - AttackIQ, CrowdStrike, Fortinet, HCA Healthcare, Lloyds Banking Group, and Microsoft - we are continuing to advance how defenders define coverage with a more accurate, repeatable way to understand the depth and quality of the detections behind it. This research offers a new approach to measuring detection coverage through two concepts:

• Implementation Coverage tells us how much of the behavior we can see.

• Detection Quality tells us how effective the signals providing that visibility are.

The result is the Detection Coverage Calculator, an automated capability that brings together ATT&CK-informed behavioral models, field-level telemetry mappings, detection quality scoring, and analytic analysis to measure what detection coverage really means.

Measuring the Behavior Behind an ATT&CK Technique

One of the foundational contributions of our research is the concept of an implementation: a behaviorally distinct way of executing an ATT&CK technique, characterized by its execution path and the system interactions required to perform it. Implementations occupy a useful middle ground in the ATT&CK model—techniques describe adversary behavior at a relatively broad level, while procedure examples can be highly specific (ex: a particular threat actor using a particular tool, command, or configuration). Implementations abstract away those incidental details while preserving meaningful differences in how the behavior is actually accomplished.

Consider an adversary creating a Windows scheduled task. One implementation might use PowerShell. Another might directly modify the Registry. Another might invoke schtasks.exe from the command line or use an XML task definition. The ultimate ATT&CK behavior may be the same, but the activity leading there—and therefore the opportunities to detect it—can be very different.

This gives us something more concrete to measure. Rather than asking only whether an analytic has been mapped to an ATT&CK technique, we can ask which known implementations its detection logic can meaningfully observe. This is implementation coverage.

If a technique has eight identified implementations and the available analytics detect two, we can describe the result as 2/8 implementation coverage. We now have evidence about the depth of the coverage behind the ATT&CK mapping and what remains outside our visibility.

Building the Implementation Catalog

Measuring implementation coverage first requires understanding the different ways techniques can be performed; to make that possible, we developed an Implementation Catalog: a scalable, behavior-focused representation of the various ways ATT&CK techniques can be executed.

We combined ATT&CK technique and procedure examples with Atomic Red Team tests to identify practical execution paths and normalize them into reusable behavioral models. Each implementation captures the execution path steps and system interactions required to perform it, supported by a reusable system-interaction taxonomy for describing those interactions consistently across techniques.

Creating the catalog at meaningful scale also required automation. We developed an LLM-driven decomposition process that transforms heterogeneous ATT&CK and Atomic Red Team source material into structured implementation data suitable for coverage analysis. The result is a model for evaluating detection coverage against how techniques can actually be performed, rather than simply whether an ATT&CK tag is present.

Measuring Detection Quality

Breadth is only one part of meaningful coverage. Detecting an implementation is less reassuring if the underlying signal is trivial for an adversary to change, or so common that defenders cannot reliably distinguish malicious activity from normal operations.

We use detection quality as an umbrella for two characteristics of a detection signal: robustness and precision.

Robustness measures how difficult a detection signal is for an adversary to evade or manipulate. An analytic based on a specific filename, hash, command-line argument, or other attacker-controlled value may work perfectly when that value appears, but an adversary may be able to defeat it with a relatively inexpensive change. More robust signals are tied to system interactions that are increasingly difficult for the adversary to avoid.

Precision measures how well a signal distinguishes malicious behavior from benign activity. A signal can be difficult for an attacker to avoid but can also occur frequently during benign activity. Without sufficient context, that signal may generate substantial noise. Conversely, a highly specific indicator may provide considerable confidence when it appears but be easy for an adversary to change. Together, robustness and precision characterize the quality of the detection logic providing coverage.

Effective detection coverage requires understanding both detection quality and implementation coverage.

Connecting Behavior, Telemetry, and Detection Logic

Automating these measurements requires connecting abstract adversary behavior to the telemetry and fields that detection logic actually uses. We extend previous sensor research with field-level telemetry information for Sysmon and Windows Security events, including mappings to the Open Cybersecurity Schema Framework (OCSF), which helps to connect the system interactions represented in the Implementation Catalog to the telemetry available to observe them.

We also developed a scoring ‘dictionary’ that assigns standardized robustness and precision values across the telemetry sources and fields represented in the project. This allows Detection Quality to be evaluated automatically rather than requiring analysts to manually assess every observable in every detection.

Bringing It Together: The Detection Coverage Calculator

The final challenge was making this analysis practical at scale.

The Detection Coverage Calculator brings together four major components we developed during this research phase:

• The Implementation Catalog describes behaviorally distinct ways ATT&CK techniques can be performed and the system interactions they require.

• Sensor Mappings connect system interactions to field-level telemetry.

• The Scoring Dictionary supports automated robustness and precision assessment.

• Our analytic ingestion mechanism parses detection content, extracts its logic and telemetry requirements, and identifies ATT&CK technique and tactic mappings.

The calculator can ingest Sigma-formatted YAML detections stored locally or in a GitHub repository and automatically calculate robustness, precision, and implementation coverage. It produces detailed spreadsheet results and supports generation of an executive-oriented coverage report via a downloadable ChatGPT Skill.

Defenders can now determine:

• Which implementations do these rules detect?

• Where are the behavioral gaps?

• How difficult are the underlying signals to evade?

• How well do those signals distinguish malicious from benign activity?

• How much confidence should we have in our detection coverage?

Two organizations can show the same technique as green on an ATT&CK heatmap while having dramatically different capabilities behind that box. By combining Detection Quality, Implementation Coverage, field-level telemetry knowledge, and automated analysis, we help defenders explain the depth and defensive value behind that coverage, and identify where it needs to improve.

Get Involved

We welcome your feedback and contributions. There are several ways that you can get involved with Summiting the Pyramid and help advance threat-informed detection engineering:

• Learn about Summiting the Pyramid on our project website. The site has everything you need to learn about our work with STP and getting started on incorporating the methodology and evaluation methods in your own environment.

• Check out our case studies. Our case study series takes an in-depth look at interesting analytic use cases, determining detection coverage of those involved with our Detection Coverage Calculator. Take a look to see how you can do the same, and if you have an interesting case study you want to share with our team, please do so we can highlight it!

• Download the Detection Coverage Calculator and try it out! Download the code from our Github repository and use the DCC to evaluate your own analytics and see what detection coverage they are actually providing.

• Join the community. Sign up for Stay Informed emails and follow us on LinkedIn for updates.

© 2026 The MITRE Corporation. Approved for Public Release. ALL RIGHTS RESERVED. Document number 26-0334.

---