The open list of missed techniques from the priority pack, with owners. Prevention and detection rates are meaningful once the pack is stable enough to compare month to month.
Metrics Guide
How to Measure the Value of a BAS Platform
The metrics that show whether a breach and attack simulation platform is working: prevention, detection, drift, retest time, and a board narrative tied to control evidence.
Evidence Before a Score
Value is closed gaps that stay closed.
BAS platform value is…
A measured change in how live controls treat known techniques: fewer unexplained misses, faster retests after a fix, and regressions that surface before an incident does.
Avoid a single maturity score. It hides whether endpoint prevention improved while SIEM detection decayed. Report by technique state and by control plane.
Leadership needs a trend they can repeat next quarter. Detection engineering needs the scenario IDs behind that trend. Both views come from the same runs.
A good metric
Counted from stored runs, comparable over time, and owned by someone who can move it.
A weak metric
A percentage of the ATT&CK matrix painted green, with no dates and no control names.
The story to tell
We ran these techniques, these failed, these were fixed and retested, and these regressed after a change.
Metrics Worth Keeping
Six numbers, each with a person attached.
Prevention rate
Share of in-scope techniques a preventive control blocked. Split by endpoint, email, and network so one strong plane cannot hide another.
Detection rate
Share that produced a usable alert. Logged-only is not detection. Count it separately or the SOC will look healthier than the queue.
Missed techniques
The open list, with owners. This is the work. A shrinking list that is actually being retested is the clearest sign of value.
Time to retest
Days from a control change to a stored retest of the same scenario. Long gaps mean the programme is still a reporting exercise.
Regressions
Passes that became misses since the previous run. This is the metric that justifies the schedule.
Accepted gaps
Misses leadership has explicitly accepted, with a review date. Acceptance is a decision. Silence is not.
Two Audiences
Show each audience the slice they can use.
| Audience | Show them | Leave in the appendix |
|---|---|---|
| CISO / board | Trend of misses, closures, and regressions | Procedure-level telemetry |
| SOC manager | Detection rate and alert quality by technique | Unrelated vulnerability totals |
| Detection engineering | Scenario ID, expected rule, last outcome | A single rolled-up percentage |
| Control owner | The misses on their plane and the retest | Other teams’ backlogs |
| Audit / GRC | Dated runs, scope, and retest evidence | A matrix with no timestamps |
| Purple team | Untested and missed techniques before the exercise | A claim that the exercise is unnecessary |
Quarterly Narrative
What changed because the platform ran.
Include
- Techniques added because of a threat report or exercise
- Misses closed, with retest dates
- Regressions caught by the schedule
- Gaps accepted on purpose, and when they will be reviewed
- Control planes that improved, and planes that did not
Leave out
- A vanity percentage of the full ATT&CK matrix
- Vendor benchmark scores from someone else’s lab
- Counts of simulations with no outcomes attached
- A claim that residual risk is now zero
- Findings from a pentest presented as BAS results
Frequently Asked QuestionsPlatform value,
Platform value,
answered.
Publish a short trend instead: misses opened, misses closed with a retest, and regressions. A single score invites false comfort and arguments about the formula.
Define “usable” with the SOC: the alert names the technique, the host or mailbox, and the time, and it maps to a rule they can tune. Then count detections that meet that bar.
No. Value tracks closed and durable gaps on techniques you meant to test. Running thousands of scenarios nobody triages lowers value.
Mark it untested or out of scope. Do not estimate a pass. The honesty of the untested state is part of the metric system.
Related reading and resources
Metrics only move if the programme, the ATT&CK mapping, and the control tests are real.
Leave with numbers you can repeat
See misses, closures, and regressions from one priority pack.
Request a Valitrix demo and look at the outcome history for a small set of techniques — the evidence a quarterly narrative has to stand on.