When 100% Coverage Isn’t Enough: Measuring Effective Detection Coverage

Traditional MITRE ATT&CK coverage assessments typically treat detections as binary, asking only whether an analytic exists for a given technique. This approach fails to capture whether a detection is resilient to implementation variations, adversary evasion, or alternative attack paths. As part of MITRE CTID's Summiting the Pyramid initiative, the presenters developed an "effective coverage" calculator that evaluates detection quality by measuring how well analytics perform across multiple technique implementations and how robust they remain against adversarial evasion opportunities. This session will present the research methodology behind the calculator, including the introduction and analysis of ATT&CK technique implementations, robustness and precision evaluation, and the framework used to quantify effective detection coverage. The presenters will demonstrate the calculator tool against a variety of Elastic and Sigma analytics and apply it to a real-world 2020 intrusion case study, showing how the methodology identifies gaps that traditional ATT&CK coverage metrics fail to expose and helps prioritize improvements to existing detections. Attendees will leave with a practical framework for evaluating detection effectiveness beyond binary ATT&CK coverage, access to the effective coverage calculator, and guidance for applying the methodology to improve detection engineering and threat hunting programs within their own environments.