Red Team Coverage Calculator

Score red team scope coverage across ATT&CK tactics, objectives achieved, detection avoided and estate actually in scope.

Inputs

ATT&CK tactics exercisedtactics

Enterprise ATT&CK has 14 tactics

Techniques executedtechniques

Objectives in scopeobjectives

Objectives achievedobjectives

Actions detected by the blue teamactions

Share of the estate in scope%

Crown-jewel systems in scope

Engagement lengthdays

Engagement Coverage Score

56.7/ 100

ATT&CK Tactic Coverage

64.3%

Objective Success Rate

66.7%

Blue Team Detection Rate

31.1%

Techniques Executed per Day

2.25per day

Assurance Limitation

Broad coverage — remaining blind spots are technique-level, not scope-level

Step by step

Values used
ATT&CK tactics exercised = 9 tactics; Techniques executed = 45 techniques; Objectives in scope = 6 objectives; Objectives achieved = 4 objectives; Actions detected by the blue team = 14 actions; Share of the estate in scope = 60 %; Crown-jewel systems in scope = Yes; Engagement length = 20 days
Red Team Coverage
coverage = 0.30×tacticCoverage + 0.30×scopeScore + 0.25×techniqueDepth + 0.15×objectiveRate, where scopeScore is the in-scope share of the estate, cut by 40% if crown jewels are excluded.
Engagement Coverage Score
= 56.7 / 100
ATT&CK Tactic Coverage
= 64.3
Objective Success Rate
= 66.7
Blue Team Detection Rate
= 31.1
Techniques Executed per Day
= 2.25 per day
Assurance Limitation
= Broad coverage — remaining blind spots are technique-level, not scope-level

How it works

Coverage is dominated by scope and breadth, not by how many objectives the red team hit — a team that owns the domain in two days has proven one path and tested very little. Excluding crown jewels caps what the engagement can tell you, so the model penalises it directly, and objective success carries the smallest weight because it says more about the estate than the assessment. This is a coverage estimate for planning the next engagement, not assurance that in-scope systems are secure. A clean red team report on 30% of the estate is not a good result — it is a narrow test, and the untested 70% is where the next intrusion will start.

Formula

Red Team Coverage

coverage = 0.30×tacticCoverage + 0.30×scopeScore + 0.25×techniqueDepth + 0.15×objectiveRate, where scopeScore is the in-scope share of the estate, cut by 40% if crown jewels are excluded.

tacticCoverage: Tactics exercised out of the 14 in Enterprise ATT&CK
scopeScore: Share of the estate the team was permitted to touch
techniqueDepth: Techniques executed, benchmarked against 120 for a broad engagement
objectiveRate: Objectives achieved out of those set

Frequently Asked Questions

How is Red Team Coverage calculated?

coverage = 0.30×tacticCoverage + 0.30×scopeScore + 0.25×techniqueDepth + 0.15×objectiveRate, where scopeScore is the in-scope share of the estate, cut by 40% if crown jewels are excluded. Coverage is dominated by scope and breadth, not by how many objectives the red team hit — a team that owns the domain in two days has proven one path and tested very little. Excluding crown jewels caps what the engagement can tell you, so the model penalises it directly, and objective success carries the smallest weight because it says more about the estate than the assessment. This is a coverage estimate for planning the next engagement, not assurance that in-scope systems are secure.

Why does Red Team Coverage matter?

A clean red team report on 30% of the estate is not a good result — it is a narrow test, and the untested 70% is where the next intrusion will start.

What values do I need to enter?

This calculator takes 8 inputs: ATT&CK tactics exercised, Techniques executed, Objectives in scope, Objectives achieved, Actions detected by the blue team, Share of the estate in scope, Crown-jewel systems in scope, Engagement length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should a high detection rate lower the coverage score?

No, they measure different things. Detection rate is the blue team's result and is reported separately; a red team that was caught constantly may still have covered every tactic in scope, which is the ideal outcome for both sides.

Why benchmark technique depth against 120?

It reflects a broad multi-week engagement across several tactics. It is a yardstick for comparing engagements over time, not a target to game — fifty well-chosen techniques against crown jewels beats two hundred noisy ones in a lab segment.

You might also need

Blue Team Readiness Calculator Purple Team Effectiveness Calculator Kill Chain Coverage Calculator