Threat Landscape & MITRE Coverage

THREAT LANDSCAPE & MITRE COVERAGE

Which attacker techniques we can actually detect is assumed rather than measured, so coverage gaps against real-world tradecraft go unseen. We find out we couldn't detect a technique after it's used.

Actors

  • SOC Manager
  • Detection Engineering Lead
  • Threat Intel Lead

Systems / Vendors

  • SIEM
  • Detection content / rules
  • Threat intelligence (TIP)

Business Question

"Which attacker techniques could we genuinely detect today, and where are the gaps against MITRE ATT&CK?"

What SPoG Does

  • Maps observed attacker techniques against detectable techniques.
  • Highlights coverage gaps mapped to MITRE ATT&CK.
  • Directs detection engineering to the biggest gaps.

Outcome Metrics

+30%

MITRE coverage

1

Live coverage map

6–10 wks

To first outcomes

Contact us to learn more →