Skip to content
ENExplore Calculators

MITRE Technique Coverage Calculator

Work out mitre technique coverage instantly with clear inputs, formula shown and shareable results.

About MITRE Technique Coverage Calculator

Technique coverage and tactic coverage answer different questions. Covering many techniques inside a few tactics leaves whole stages of the kill chain unobserved, so an intrusion passes through undetected regardless of the impressive technique count. Blending the two puts weight on breadth across tactics, which is what actually gives multiple chances to catch an intrusion.

Formula

Coverage blend

technique coverage = covered / total techniques; tactic coverage = tactics with any detection / tactics; score = mean of the two

Worked example

With the default values below, MITRE Technique Coverage Calculator returns Kill-chain coverage score of 66.5. Change any input above and every figure here is recalculated in your browser.

Inputs used

Tactics assessedaccepts 1–14
14
Techniques with detectionsminimum 0
95
Techniques in the matrix subsetminimum 1
201
Tactics with no coverage at allminimum 0
2

Results

Kill-chain coverage score
66.5
Technique coverage
47.3%
Tactic coverage
85.7%
Techniques covered per tactic
6.8

Step by step

  1. 1Values used
  2. 2Coverage blend
  3. 3Kill-chain coverage score= 66.5
  4. 4Technique coverage= 47.3
  5. 5Tactic coverage= 85.7
  6. 6Techniques covered per tactic= 6.8

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Which tactics are most often uncovered?

Collection, exfiltration and impact, because they need data-flow and file-access telemetry rather than the process and authentication logs most teams start with.

Is one detection per technique enough?

No. Techniques have many procedures, so a single rule usually catches one implementation. Depth per technique matters as much as breadth across the matrix.

Related Calculators

MITRE Technique Coverage Calculator | Calcrivo