Use case
ATT&CK coverage assessment
For CISOs and security leaders who need a defensible answer to the question "what does our threat intelligence actually cover against MITRE ATT&CK®?" — and the coverage gaps worth investing against.
Who this is for
CISOs, deputy CISOs, threat intelligence directors, and security architects briefing executive leadership, audit committees, or regulators on the organization's intelligence posture. Anyone who has been asked "are we covered against ransomware tactics?" and felt the gap between "we have feeds for that" and a defensible answer.
The operational pain
ATT&CK has become the lingua franca of cyber defense, which means everyone above the CISO expects coverage to be measured against it. A coverage answer based on "we subscribe to these vendors and they say they cover everything" survives exactly one follow-up question. A coverage answer based on a portfolio measurement against the ATT&CK matrix — with techniques covered, techniques uncovered, and weighted relevance — does not.
The pain is most acute when leadership wants to compare quarters. Did this year's $300K addition actually change posture, or just add overlap? Without a measured coverage baseline, the question is unanswerable.
How Intel Fusion helps
Intel Fusion produces a tactic-level and technique-level coverage matrix across the full CTI portfolio. Coverage is reported three ways: per-source (what each feed claims and substantiates), portfolio union (probability that at least one source covers each technique), and weighted (after applying sector and adversary relevance). The same matrix is the artifact for an executive briefing, a regulatory submission, and an analyst-level deep dive — there is no separate version for each audience.
The methodology behind the matrix is documented on the ATT&CK technique mapping methodology page, so anyone challenging a coverage number can see exactly how it was derived.
Expected outcomes
- A defensible portfolio coverage number suitable for executive reporting.
- A ranked list of uncovered techniques with candidate sources to close each.
- Quarter-over-quarter coverage deltas after each portfolio change.
- A documented methodology that survives audit and peer review.
Relationship to ATT&CK
Coverage assessment is one place where ATT&CK alignment is not optional — it is the entire point of the exercise. Intel Fusion handles ATT&CK versioning so coverage scores remain comparable across matrix updates, and supports profile overlays (for example, NNSA Cyber Threat Profile) for organizations with sector-specific framings.
Related
Bring a measured ATT&CK coverage answer to your next briefing.
Request a demo to see your portfolio's coverage matrix in operational detail.