Field note · Logged September 2026
MITRE ATT&CK coverage: what it means and how teams measure it
The 15 Enterprise tactics, and the difference between a coverage claim and tested coverage.
Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18
About 3 minutes
What is MITRE ATT&CK?
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques based on real-world observations, maintained by The MITRE Corporation at attack.mitre.org. The Enterprise matrix, at version 19.2 in September 2026, has 15 tactics. Two changes matter for anyone comparing older material: TA0005 is now named Stealth, and a new tactic, Defense Impairment (TA0112), was created on 14 April 2026. Coverage maps built against earlier versions show 14 tactics.
Source: attack.mitre.org · attack.mitre.org/tactics/TA0112 · Reviewed Sep 2026
| ID | Name | MITRE's description |
|---|---|---|
| TA0043 | Reconnaissance | "The adversary is trying to gather information they can use to plan future operations." |
| TA0042 | Resource Development | "The adversary is trying to establish resources they can use to support operations." |
| TA0001 | Initial Access | "The adversary is trying to get into your network." |
| TA0002 | Execution | "The adversary is trying to run malicious code." |
| TA0003 | Persistence | "The adversary is trying to maintain their foothold." |
| TA0004 | Privilege Escalation | "The adversary is trying to gain higher-level permissions." |
| TA0005 | Stealth | "The adversary is trying to hide and conceal their actions, appearing as normal behavior." |
| TA0112 | Defense Impairment | "The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can't see or trust what's happening." |
| TA0006 | Credential Access | "The adversary is trying to steal account names and passwords." |
| TA0007 | Discovery | "The adversary is trying to figure out your environment." |
| TA0008 | Lateral Movement | "The adversary is trying to move through your environment." |
| TA0009 | Collection | "The adversary is trying to gather data of interest to their goal." |
| TA0011 | Command and Control | "The adversary is trying to communicate with compromised systems to control them." |
| TA0010 | Exfiltration | "The adversary is trying to steal data." |
| TA0040 | Impact | "The adversary is trying to manipulate, interrupt, or destroy your systems and data." |
How do teams measure ATT&CK coverage?
- Mapping detections to techniques: each deployed rule or hunt is tagged with the ATT&CK techniques it is meant to find.
- Coverage views: those mappings are rolled up into a matrix or heatmap that shows which tactics and techniques have at least one detection, and which have none.
- Testing detections: a technique counts as covered only when a detection for it has been run against past data or a simulated attack and has fired as expected.
- Checking data sources: a detection for a technique is only useful if the logs that show that technique are collected.
What is the difference between a coverage claim and tested coverage?
A coverage claim says detections are mapped to ATT&CK. Tested coverage shows that a detection for a given technique runs on your data and fires when that technique happens. A mapped rule that has never been tested, or that depends on logs you do not collect, appears on a coverage map without finding anything. Ask to see tested coverage against your own environment before treating a map as evidence.
Why is vendor coverage hard to compare?
Coverage depends on the customer. A tool can only detect a technique if the data that shows it is available, and if a rule or hunt for it is deployed and working. A vendor saying 'full ATT&CK coverage' tells you little until you see it against your own data.
What should you ask a vendor about ATT&CK coverage?
- Which tactics and techniques do your out-of-the-box hunts and detections cover, and can I see the list?
- Which data sources does each one need, and do I have them?
- How do you measure coverage in my environment, and how often is it recalculated?
- Which version of ATT&CK is your mapping built on, and does it include Stealth (TA0005) and Defense Impairment (TA0112)?
- How do you show a technique as covered: a deployed rule, a tested rule, or a detection that fired in a test?