How do you use MITRE ATT&CK to measure detection coverage, and how can a coverage heatmap mislead you?

TL;DR: ATT&CK catalogues adversary tactics (goals such as persistence or credential access) and techniques (ways of achieving them), with procedures observed in real intrusions. Use it to prioritise (which techniques do actors targeting us use, and which sit at choke points), to map existing detections and data sources, to find gaps, and to plan emulation tests. Heatmaps mislead when one rule for one procedure turns a technique green, when untested rules count as coverage, when data sources are missing on part of the estate, and when the map ignores prevention and response. Measure coverage per technique as tested detections across the procedures that matter, on the share of assets that actually send the data.

How to approach it

Explain ATT&CK's structure briefly, then the uses in order (prioritise, map, find gaps, test), then the specific ways coverage claims go wrong, and what an honest metric looks like. Mention MITRE ATLAS as the AI-system counterpart.

A strong answer

Structure. Tactics are the attacker's objectives. Enterprise ATT&CK has 15 of them since version 19 (April 2026): reconnaissance, resource development, initial access, execution, persistence, privilege escalation, stealth, defense impairment, credential access, discovery, lateral movement, collection, command and control, exfiltration and impact. Version 19 split the old defense evasion tactic into stealth (TA0005, avoiding detection) and defense impairment (TA0112, disabling or degrading defences), so older coverage maps need re-labelling. Techniques and sub-techniques are how they achieve them (for example, OS Credential Dumping: LSASS Memory). Procedures are specific implementations seen in the wild. Each technique lists data sources and detection ideas.

Using it well.

1. Prioritise. Pull techniques used by threat groups relevant to your sector and those common across ransomware intrusions from threat intelligence, and weight choke-point techniques (credential access, lateral movement, persistence) that most intrusions must pass.
2. Map. Tag each detection with the techniques it addresses and the data sources it needs; map which data sources you collect, from which share of assets.
3. Find gaps. Techniques that are high priority and have no tested detection, or no data source.
4. Test. Run emulations of the prioritised procedures (with an adversary emulation framework, or a purple-team exercise) and record which fired, which were blocked, which were missed.
5. Plan. Close gaps by adding telemetry, writing detections, or adding preventive controls.

How heatmaps mislead.

• One procedure, whole technique. A rule detecting one tool's way of dumping credentials turns "OS Credential Dumping" green while other methods pass silently.
• Untested rules. A rule that has never been shown to fire, or that broke when a log field changed, still counts.
• Partial telemetry. Coverage on the 60 percent of servers that forward logs looks like 100 percent on the map.
• Detection only. A technique fully prevented (blocked by application control) looks like a gap; one detected but never responded to looks covered.
• Equal weighting. Ten green low-value techniques can hide one red critical one.
• Incentives. Teams asked to "turn the map green" write shallow rules.

An honest coverage measure. For each prioritised technique: the procedures you expect, whether each is prevented, detected (with a tested rule), or missed in the latest emulation, and the share of in-scope assets with the necessary telemetry. Report trends over time and the top gaps by risk, not percentages of the whole matrix.

AI systems. MITRE ATLAS applies the same structure to attacks on and through AI systems (for example prompt injection, model extraction, poisoning, and agent-specific techniques in recent releases). Mapping AI detections and tests to ATLAS, alongside ATT&CK for the surrounding infrastructure, gives the same planning benefits; re-check identifiers against the current release, since ATLAS updates frequently and renamed a tactic in 2026.

What interviewers probe next

• "Leadership wants a coverage percentage. What do you give them?" Coverage of prioritised techniques by tested detection or prevention, on the assets in scope, with the top gaps and the trend, rather than a whole-matrix percentage.
• "How do you avoid writing rules just to fill cells?" Prioritise by threat intelligence and choke points, require tests and runbooks, and measure precision in production.
• "What's the difference between purple teaming and red teaming here?" Purple teaming runs techniques collaboratively with defenders watching, to test and improve detection in real time; red teaming tests the whole organisation's response without warning.

What if?

How it's scored

Weak: "We map our rules to ATT&CK and aim for full coverage."

Hire: Uses ATT&CK to prioritise with threat intelligence, maps detections and data sources, finds gaps, and tests with emulation.

Strong Hire: Lists the specific ways heatmaps mislead (procedure versus technique, untested rules, partial telemetry, prevention ignored, equal weighting, incentives), defines an honest coverage metric with asset scope and test results, and extends the approach to AI systems with ATLAS.

Common mistakes

• Counting a technique as covered because one rule mentions it.
• Ignoring whether all assets send the required data.
• Treating the matrix as a checklist to complete.
• Forgetting preventive controls in the picture.