Skip to content
ENExplore Calculators

Threat Detection Coverage Calculator

Work out threat detection coverage instantly with clear inputs, formula shown and shareable results.

About Threat Detection Coverage Calculator

Counting techniques with any detection overstates coverage, because a low-confidence rule that fires constantly is not usable in practice. Weighting high-confidence detections fully and weaker ones at half gives a figure that tracks real capability. Techniques covered per log source shows where adding one telemetry type would close many gaps at once.

Formula

Weighted coverage

coverage = (high-confidence + 0.5 x partial) / techniques in scope; blind spots = in scope - any detection

Worked example

With the default values below, Threat Detection Coverage Calculator returns Confidence-weighted detection coverage of 42.5%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Techniques relevant to your threat modelminimum 1
120
Techniques with at least one detectionminimum 0
68
Techniques with high-confidence detectionminimum 0
34
Log source types deployedminimum 1
9

Results

Confidence-weighted detection coverage
42.5%
Raw technique coverage
56.7%
Techniques with no detection at all
52
Techniques covered per log source
7.6

Step by step

  1. 1Values used
  2. 2Weighted coverage
  3. 3Confidence-weighted detection coverage= 42.5
  4. 4Raw technique coverage= 56.7
  5. 5Techniques with no detection at all= 52
  6. 6Techniques covered per log source= 7.6

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Should coverage be measured against all of MITRE ATT&CK?

No. Scope it to the techniques used by the threat groups relevant to your sector and technology, otherwise the denominator is dominated by irrelevant platforms.

What single log source adds the most coverage?

Endpoint process and command-line telemetry, followed by authentication logs. Together they touch the majority of commonly observed techniques.

Related Calculators

Threat Detection Coverage Calculator | Calcrivo