Your CISO has seen an ATT&CK coverage heat map showing 70% of techniques as "covered" and wants to know if that means we are 70% secure. What do you say?

No, and I would want to be direct about that while making the map useful rather than just dismissing it.

The percentage treats every technique as equivalent, and they are not. Techniques differ enormously in how likely they are to be used against us, how much damage they enable, and how detectable they are at all. A heat map counting squares gives phishing and some rarely-observed technique the same weight.

"Covered" is also doing a lot of work. In most tooling that square goes green when one detection rule exists that touches the technique. That rule might catch one specific procedure out of dozens, might only fire on a subset of platforms, and might be tuned so aggressively that it never fires in practice. Green means "we have something", not "we would catch this".

There are two further gaps. ATT&CK is built from publicly reported intrusions, so it is a knowledge base rather than a complete enumeration — a technique missing from the matrix is not a technique adversaries do not use. And detection is not prevention: a technique we detect but cannot prevent or respond to quickly is not the same as one we block.

What I would offer instead: take the intrusion sets that actually target our sector, build a layer of the techniques they are known to use, weight it by how frequently each appears, and measure coverage against that. That produces a much smaller and more honest set — usually a few dozen techniques — and a gap list that maps directly to detection engineering work. I would also want to validate a sample of the "covered" ones by actually testing them, because the difference between a rule existing and a rule working is where most of the risk sits.

The map is useful for communication and for finding obvious holes. It is not a security score, and I would rather we did not report it as one.