Skip to content
ENExplore Calculators

Red Team Coverage Calculator

Score red team scope coverage across ATT&CK tactics, objectives achieved, detection avoided and estate actually in scope.

About Red Team Coverage Calculator

Coverage is dominated by scope and breadth, not by how many objectives the red team hit — a team that owns the domain in two days has proven one path and tested very little. Excluding crown jewels caps what the engagement can tell you, so the model penalises it directly, and objective success carries the smallest weight because it says more about the estate than the assessment. This is a coverage estimate for planning the next engagement, not assurance that in-scope systems are secure. A clean red team report on 30% of the estate is not a good result — it is a narrow test, and the untested 70% is where the next intrusion will start.

Formula

Red Team Coverage

coverage = 0.30×tacticCoverage + 0.30×scopeScore + 0.25×techniqueDepth + 0.15×objectiveRate, where scopeScore is the in-scope share of the estate, cut by 40% if crown jewels are excluded.

tacticCoverage
Tactics exercised out of the 14 in Enterprise ATT&CK
scopeScore
Share of the estate the team was permitted to touch
techniqueDepth
Techniques executed, benchmarked against 120 for a broad engagement
objectiveRate
Objectives achieved out of those set

Worked example

With the default values below, Red Team Coverage Calculator returns Engagement Coverage Score of 56.7. Change any input above and every figure here is recalculated in your browser.

Inputs used

ATT&CK tactics exercisedaccepts 0–14 tactics
9 tactics
Techniques executedaccepts 1–5,000 techniques
45 techniques
Objectives in scopeaccepts 1–200 objectives
6 objectives
Objectives achievedaccepts 0–200 objectives
4 objectives
Actions detected by the blue teamaccepts 0–5,000 actions
14 actions
Share of the estate in scopeaccepts 1–100 %
60 %
Crown-jewel systems in scope
Yes
Engagement lengthaccepts 1–365 days
20 days

Results

Engagement Coverage Score
56.7 / 100
ATT&CK Tactic Coverage
64.3%
Objective Success Rate
66.7%
Blue Team Detection Rate
31.1%
Techniques Executed per Day
2.25 per day
Assurance Limitation
Broad coverage — remaining blind spots are technique-level, not scope-level

Step by step

  1. 1Values used
  2. 2Red Team Coverage
  3. 3Engagement Coverage Score= 56.7 / 100
  4. 4ATT&CK Tactic Coverage= 64.3
  5. 5Objective Success Rate= 66.7
  6. 6Blue Team Detection Rate= 31.1
  7. 7Techniques Executed per Day= 2.25 per day
  8. 8Assurance Limitation= Broad coverage — remaining blind spots are technique-level, not scope-level

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Red Team Coverage calculated?

coverage = 0.30×tacticCoverage + 0.30×scopeScore + 0.25×techniqueDepth + 0.15×objectiveRate, where scopeScore is the in-scope share of the estate, cut by 40% if crown jewels are excluded. Coverage is dominated by scope and breadth, not by how many objectives the red team hit — a team that owns the domain in two days has proven one path and tested very little. Excluding crown jewels caps what the engagement can tell you, so the model penalises it directly, and objective success carries the smallest weight because it says more about the estate than the assessment. This is a coverage estimate for planning the next engagement, not assurance that in-scope systems are secure.

Why does Red Team Coverage matter?

A clean red team report on 30% of the estate is not a good result — it is a narrow test, and the untested 70% is where the next intrusion will start.

What values do I need to enter?

This calculator takes 8 inputs: ATT&CK tactics exercised, Techniques executed, Objectives in scope, Objectives achieved, Actions detected by the blue team, Share of the estate in scope, Crown-jewel systems in scope, Engagement length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should a high detection rate lower the coverage score?

No, they measure different things. Detection rate is the blue team's result and is reported separately; a red team that was caught constantly may still have covered every tactic in scope, which is the ideal outcome for both sides.

Why benchmark technique depth against 120?

It reflects a broad multi-week engagement across several tactics. It is a yardstick for comparing engagements over time, not a target to game — fifty well-chosen techniques against crown jewels beats two hundred noisy ones in a lab segment.

Related Calculators

Red Team Coverage Calculator | Calcrivo