It needs to identify techniques honestly. You do not need to run the entire Enterprise matrix before the programme is valuable. Prioritise techniques tied to your controls and threat profile, and label everything else untested.
ATT&CK Guide
MITRE ATT&CK Mapping for a BAS Platform
How a breach and attack simulation platform should use MITRE ATT&CK: technique-level results, honest coverage, and a heatmap of your live controls rather than a logo on a matrix.
A Shared Language for Results
ATT&CK is the index. Your controls are the measurement.
MITRE ATT&CK in a BAS platform means…
Every simulation carries a tactic and technique identifier, and every result says whether your controls blocked, detected, logged, or missed that technique — so coverage is a property of the live stack, not of the vendor’s brochure.
Platform pages in this category all show an ATT&CK matrix. The matrix is useful when a cell opens onto a dated test, a control name, and an outcome. A coloured cell with no underlying run is a picture.
One successful simulation does not prove a technique is “covered”. Sub-techniques and procedures differ. Report the procedures you ran.
Store the identifier
Tactic, technique, and sub-technique IDs belong on the scenario and on the result. They should survive export to the SIEM and the ticket.
Separate tested from detected
A technique you have never run is untested. A technique you ran and missed is a gap. Those are different management problems.
Keep the procedure visible
The heatmap should say which procedure ran. Two procedures under one technique can produce opposite results.
How to Use the Matrix
Make the heatmap operable.
01
Tag every scenario
Bind each simulation to the ATT&CK technique it actually exercises. If it spans two techniques, record both rather than picking the more impressive label.
02
Mark tested, detected, missed
Untested, blocked, detected, logged only, and missed are separate states. A single green “covered” status collapses them.
03
Read by control
The same technique can be blocked on the endpoint and invisible in the SIEM. The heatmap needs a control dimension, not only a tactic column.
04
Prioritise the gaps you can name
Start remediation with missed techniques that match your threat reports and that a named owner can change. Do not boil the matrix.
Mapping Mistakes
Patterns that make a matrix misleading.
Coverage by installation
Claiming a technique is covered because a product lists it. Coverage starts when a simulation against your tenant produces a result.
One test, whole technique
A single procedure painted across every sub-technique. Keep the procedure name next to the colour.
Detection without prevention
A green cell because a log line existed. State whether the outcome was blocked, detected, or only logged.
No date on the cell
A result from last year presented as current posture. Show the last run, and fade anything older than your cadence.
Heatmap States
What each state should mean.
| State | Meaning on your stack |
|---|---|
| Untested | No authorised simulation has run for this technique |
| Blocked | A preventive control stopped the procedure you ran |
| Detected | An alert fired with enough context to investigate |
| Logged only | Evidence reached a log, and no detection rule fired |
| Missed | The procedure completed with no block and no useful alert |
| Partial | One control caught it and another control in the path did not |
| Stale | The last run is older than the agreed cadence |
Frequently Asked QuestionsATT&CK mapping,
ATT&CK mapping,
answered.
Yes when your detections are written at that level. A pass on one sub-technique is not a pass on its neighbours. Store the most specific ID the scenario justifies.
Share it before the exercise so operators spend time on untested or missed techniques, and on creative paths the library does not contain. After the exercise, encode repeatable findings as scenarios.
They can support a control narrative when each cited technique has a date, a scope, an outcome, and a retest. A matrix screenshot without those fields will not survive a detailed question.
Detection engineering owns the binding between scenario and technique ID. When ATT&CK updates a technique, someone reviews the scenarios that cited the old ID.
Related reading and resources
The matrix is only useful next to the controls and the programme that keep results current.
See a heatmap with dates on it
See technique results from your controls, not a poster.
Request a Valitrix demo and open a technique result: the ID, the control, the outcome, and the last time it ran.