An ATT&CK coverage heatmap shows which techniques you have at least one detection for. It does not show whether those detections work, fire on the right data or get acted on. Use the map to find gaps and plan tests, not as a score.
What the tools are for
MITRE describes ATT&CK as a knowledge base of adversary behavior. Its Navigator is an interactive tool for visualizing defensive coverage, planning red and blue team work and tracking how often techniques are detected. The heatmap is a view you build from your own data.
Myth 1: Green means covered
Fact: Green usually means a rule exists and is mapped to the technique. It says nothing about log availability, rule quality or whether anyone responds. Test the rule against a safe simulation of the behavior before you color the cell.
Myth 2: More green is better
Fact: A technique has many ways of being carried out. One rule for a technique covers some of them. MITRE notes that tactics and techniques describe the why and the how, and procedures are specific real-world implementations. A single mapped rule may catch one procedure and miss the rest.
Myth 3: ATT&CK lists everything attackers do
Fact: MITRE says ATT&CK is not a complete list of every threat group, and its coverage depends on public reporting and contributions. Gaps in your map are not the full set of gaps in your defense.
Myth 4: The tactics are a sequence to cover left to right
Fact: The FAQ states tactics are unordered and may not all appear in one intrusion. Do not treat the matrix like a checklist to complete in order.
Myth 5: An AI tool can map our rules for us
Fact: A model can suggest mappings quickly, and they are often reasonable. They also include wrong ones. Have an analyst verify each mapping, particularly for rules a model wrote. Mapping text to a technique is a judgment about behavior.
Making the heatmap useful
- Start from your threats, not the whole matrix. Choose techniques relevant to your sector and systems.
- Score each with more than one value: log available, rule exists, rule tested, response defined.
- Record when each test was done.
- Pick the gaps with the most risk and fix a few per quarter.
- Feed hunting results into the map, as described in hypothesis driven threat hunting.
For reading technique pages, see how to read an attack technique page. For the vocabulary, see MITRE ATT&CK tactics, techniques and sub-techniques.
Quick check
Is a heatmap enough for an audit or a board report?
It is a useful picture, but pair it with test results and response evidence. A map of rules alone overstates your position.
How often should we refresh it?
When you change detections or log sources, and on a regular review schedule you set. MITRE updates ATT&CK itself on a regular basis, so also check for new versions.
Sources
Last reviewed: 19 October 2026.
