Kill Chain Coverage Calculator

coverage = 0.20×delivery + 0.20×exploitation + 0.18×installation + 0.17×C2 + 0.15×actions + 0.05×reconnaissance + 0.05×weaponisation. Reconnaissance and weaponisation happen on infrastructure you do not own, so they carry low weight — you can rarely act there. The stages you control are weighted by how much damage is avoided by breaking there: stopping delivery costs nothing, stopping actions on objectives means the adversary already had your data. Because the stages are sequential, coverage compounds, so even modest coverage at every stage makes end-to-end success unlikely.

The point of the kill chain is that you only have to break it once — but breaking it at 'actions on objectives' means the intrusion succeeded and you merely watched the exit.

This calculator takes 8 inputs: Reconnaissance coverage, Weaponisation coverage, Delivery coverage, Exploitation coverage, Installation coverage, Command and control coverage, Actions on objectives coverage, Share of that coverage that prevents rather than detects. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

The kill chain gives you seven coarse phases for reporting and investment decisions; ATT&CK gives you hundreds of concrete techniques within them. Score direction here, then use an ATT&CK matrix to decide which specific techniques to instrument.

Only approximately. It assumes stages are independent, and in reality one strong adversary capability — valid credentials, say — weakens several stages at once. Treat the number as a prioritisation estimate rather than a probability you would bet on.