Design Partner Program
Home/Blog/ATT&CK detection coverage
HAYROK LABS RESEARCH NOTE HL-RN-2026-06 ATT&CK V20

How to validate detection coverage against MITRE ATT&CK

Your ATT&CK heatmap counts rules. Attackers count gaps. Here is a five-level coverage ladder that turns a colored matrix into proof.

Nov 2, 2026 @Melly 10 min read
TL;DR
01
A green ATT&CK cell means a rule exists. It does not mean the rule gets data, fires, survives a renamed binary or leads to action.
02
Score each technique on a five-level ladder and count only levels 3 to 5 as coverage. Pin every figure to an ATT&CK version, which is v20 as of October 2026.
03
Further down: a Navigator layer scored by ladder level, and a short script that turns validation results into honest coverage numbers.

Most ATT&CK coverage reports count matrix cells that contain at least one detection rule. That number tells you a rule exists. It does not tell you the rule receives data, fires on the behavior, survives a simple variation or leads to action. In this note we define a five-level coverage ladder, show how to validate each level with safe behaviors, and keep the measure honest as ATT&CK changes twice a year. The payoff: a coverage figure a CISO can defend to a board and a detection engineer can act on.

Key findings

ATT&CK V20 · 13 OCT 2026
9
New Enterprise techniques and sub-techniques for AI behavior, including prompt injection and AI-enabled exfiltration.
ATT&CK V19 · 28 APR 2026
15 · 222 · 475
Tactics, techniques and sub-techniques after Defense Evasion split into Stealth and Defense Impairment.
STRUCTURED DETECTION GUIDANCE
697 · 1,758
Enterprise Detection Strategies and Analytics in v19, replacing free text since v18.
REAL COVERAGE IN PRODUCTION
21%
Of techniques detected. Only 4 of the top 10 covered, and 13% of rules would never fire.

Put simply: a coverage map that was accurate in March is wrong in November.

Any coverage figure without a version and a validation date is a guess.

Why the heatmap misleads

The classic coverage heatmap has three structural flaws, and they all push in the same direction.

It counts existence, not effect

A cell turns green when a rule is mapped to it. Nobody checks whether the rule ever fired.

It treats all techniques as equal

A gap in a technique used against your sector counts the same as one nobody uses against you.

It ignores variation

A rule keyed to one tool name catches the demo and misses the attacker who renames the binary.

The matrix ends up looking greener than the defense really is. That is the most dangerous kind of report, because it is the one nobody questions.

The coverage ladder

Each rung asks a harder question than the one below it. Score every technique by the highest rung it has proven.

L5
Proven on a path
Fires on attack-path assets, and the SOC acts in time.
COUNTS
L4
Robust to variation
Survives renamed binaries, different parents, alternate protocols.
COUNTS
L3
Fires on a real behavior
A safe behavior ran and the alert arrived.
COUNTS
COVERAGE LINE
L2
Data present
The required telemetry actually arrives.
CLAIM
L1
Mapped
A rule exists and is tagged to the technique.
CLAIM · TYPICAL HEATMAP
A typical heatmap reports level 1. Only levels 3 to 5 tell you whether an attacker using that technique would be caught.

The method: validate coverage level by level

01

Pin the version

Record the ATT&CK version next to every coverage figure. Remap after each April and October release, starting with techniques that moved, split or were added.
02

Weight by threat

Build your priority set from the groups and campaigns that target your sector, plus the techniques on your own attack paths. Report coverage for this set first.
03

Check the data → L2

For each priority technique, use its Detection Strategy and Data Components to confirm the required telemetry actually arrives.
04

Fire the rule → L3

Run a safe behavior for the technique and confirm an alert. This is the first level that counts as coverage.
05

Vary the behavior → L4

Rerun with realistic variations: renamed binaries, different parent processes, alternate protocols. Rules that survive are robust.
06

Prove it on a path → L5

Confirm the alert fires when the behavior runs on assets that sit on real attack paths, and that the SOC acts on it in time.

Worked example: a heatmap that tells the truth

Let's rebuild the familiar heatmap so the color actually means something. Instead of "rule exists," each cell's score is the highest ladder level the technique has proven.

PRIORITY SET · SCORED BY LADDER LEVEL
T1003.001
L5
Proven on path assets
T1021.001
L4
Robust to variation
T1059.001
L2
Data present, rule timed out
T1562.001
L1
Mapped, never fired
MAPPED · L1+
100%
VALIDATED · L3+
50%
ROBUST · L4+
50%

Step 1: record results with a version and a date

results-attack-v20.json
[
  { "technique": "T1003.001", "level": 5, "validated": "2026-10-29" },
  { "technique": "T1059.001", "level": 2, "validated": "2026-11-02", "note": "rule timed out" },
  { "technique": "T1562.001", "level": 1, "validated": "2026-10-15", "note": "mapped, never fired" },
  { "technique": "T1021.001", "level": 4, "validated": "2026-10-29" }
]

Step 2: compute coverage the honest way

Python
import json

results = json.load(open("results-attack-v20.json"))
priority = {"T1003.001", "T1059.001", "T1562.001", "T1021.001"}

scored = [r for r in results if r["technique"] in priority]
mapped    = sum(r["level"] >= 1 for r in scored) / len(priority)
validated = sum(r["level"] >= 3 for r in scored) / len(priority)
robust    = sum(r["level"] >= 4 for r in scored) / len(priority)

print(f"mapped {mapped:.0%} | validated {validated:.0%} | robust {robust:.0%}")
# mapped 100% | validated 50% | robust 50%

Same four techniques, two very different stories. The classic heatmap reports 100%. The ladder reports 50%, and tells you exactly which two techniques to fix.

Step 3: export a Navigator layer

navigator-layer.json
{
  "name": "Validated coverage, priority set",
  "domain": "enterprise-attack",
  "versions": { "attack": "20", "layer": "4.5" },
  "gradient": { "colors": ["#ffffff", "#2e7d32"], "minValue": 0, "maxValue": 5 },
  "techniques": [
    { "techniqueID": "T1003.001", "score": 5, "comment": "proven on path assets" },
    { "techniqueID": "T1059.001", "score": 2, "comment": "data present, rule timed out" },
    { "techniqueID": "T1562.001", "score": 1, "comment": "mapped, never fired" },
    { "techniqueID": "T1021.001", "score": 4, "comment": "robust to variation" }
  ]
}

Load it into the ATT&CK Navigator and the matrix finally shows what it should: deep green where you are proven, pale where you only have a claim.

T1562.001, Disable or Modify Tools, sits under the new Defense Impairment tactic in v19 and later. A level 1 score there is exactly the gap an EDR killer walks through. More on that in the EDR validation note.

How to measure the outcome

Report these five, and always with the ATT&CK version and the last validation date beside them.

Validated coverage
The share of priority techniques at level 3 or higher.
Robust coverage
The share at level 4 or higher, meaning the detection survives variation.
Mapped but unproven
Techniques with a rule that has not fired on a validated behavior. This is your hidden risk.
Version lag
Days between an ATT&CK release and a remapped, revalidated priority set.
New technique coverage
Coverage of techniques added in the latest release, including the v20 AI techniques where relevant.

How Hayrok approaches ATT&CK coverage

Hayrok measures coverage by proof, not by mapping.

Runs safe behaviors from the Scenario Library, mapped to the current ATT&CK release, through a Private Runner in your environment.
Records the ladder level each run reached, with the telemetry, the alert and the latency.
AGIE
Overlays your attack paths, so gaps on techniques that lead to a crown jewel rise to the top.
Release tracking
When MITRE ships a new release, Hayrok flags priority techniques that moved and schedules them for revalidation.

So the coverage figure you report is always tied to a version, a date and a stored result.

FAQ

What does detection coverage against MITRE ATT&CK mean?

It is the share of ATT&CK techniques relevant to you for which a detection reliably fires on real behavior and leads to action. Mapped rules alone are not coverage.

What is the current version of MITRE ATT&CK?

As of November 2026, the current release is ATT&CK v20, published on 13 October 2026. MITRE ships major releases every April and October.

Should we aim for 100% ATT&CK coverage?

No. Aim for validated, robust coverage of the techniques that matter to your sector and sit on your attack paths.

How did the Defense Evasion split affect coverage reports?

ATT&CK v19 replaced Defense Evasion with Stealth and Defense Impairment. Rules and reports mapped to the old tactic need remapping before results compare cleanly.

How often should ATT&CK coverage be validated?

Revalidate after every ATT&CK release, after rule or log source changes and on a regular cadence for your priority set.

Replace your heatmap with proof

We will validate your priority techniques against ATT&CK v20 and show which cells are proven, which are robust and which are only mapped.

At Hayrok Labs we question everything and Validate what matters.

KEEP READING