What an ATT&CK coverage claim should show

Mapped rules are not the same as a coverage view

MITRE ATT&CK is a public knowledge base of adversary behaviour. Many vendors say their detection rules are ATT&CK-mapped, meaning each rule is tagged with the tactic and technique it detects. That is useful, but it is a property of each rule. A coverage view goes further: it adds up the mapped rules in your environment and shows, technique by technique, what is covered and what is not.

That is why this site scores coverage measurement against ATT&CK on what public material shows about measurement: a coverage view, a heatmap, scores, or named tactics and techniques. Mars Security, for example, describes ATT&CK-mapped rules, but we found no public coverage view, so it scores 2 of 5 on this row. The top score on this row, 4 of 5, goes to tools whose pages describe coverage scoring or a coverage view.

What changed in ATT&CK in 2026?

A coverage view is only as current as the ATT&CK version behind it. ATT&CK v19, released in April 2026, replaced the Enterprise Defense Evasion tactic with two tactics, Stealth and Defense Impairment (TA0112, created on 14 April 2026). The Enterprise matrix now lists 15 tactics and 222 techniques. MITRE's updates page dates v19.2, its first smaller agile release, to 6 August 2026. A view built on the old tactic list will file rules under a tactic that no longer exists, so ask which version a vendor's view uses.

What should a coverage view show?

1. Techniques, not only tactics. Fifteen tactic boxes that all show some coverage can hide large gaps inside each one.
2. Which rules map to each technique, so a reviewer can open the rule behind a covered cell.
3. Gaps you can act on: techniques with no rule, and techniques whose only rule is disabled.
4. The ATT&CK version the view uses, and the date it was last updated.

How do the six tools describe coverage?

Anvilogic describes coverage scoring against ATT&CK and thousands of MITRE-mapped detections. Cotool maps the whole detection suite across sources onto ATT&CK to monitor coverage and surface gaps. Vega describes a security assessment that shows real ATT&CK coverage and the gaps. Nebulock's documentation references a MITRE Coverage feature, and Artemis Security claims comprehensive MITRE coverage from day one. Each score and its reason is on the matrix.

Why does coverage carry only 8% here?

Coverage reporting matters a great deal to some teams, for example those who report to a board or an auditor. On this site it carries 8% because the buyer question is about turning intelligence into hunts and detections on existing data, not about reporting. If coverage reporting is your main need, raise its weight in the calculator and see how the order changes.