What is the Validated Coverage Score?

The Validated Coverage Score measures what proportion of an organisation's in-scope ATT&CK techniques have detection that has been proven to fire, rather than merely deployed. Each technique scores 0 for no telemetry, 1 for telemetry only, 2 for deployed detection logic and 3 for validation observed within a recency window. VCS is the achieved points divided by three times the in-scope technique count.

Home › Methodology › Validated coverage

The Validated Coverage Score

The Validated Coverage Score replaces “percentage of ATT&CK covered” with a number that distinguishes a rule that exists from a detection proven to fire — computed only over the techniques you scoped as genuinely relevant.

The four statuses

No telemetry. You are blind to it.

Telemetry only. Queryable after the fact; nothing alerts.

Detection logic exists, deployed and healthy, but unproven.

Validated by emulation. Executed against, observed to fire, within the recency window.

VCS = achieved points / (3 × in-scope techniques)

Two rules make it meaningful

In-scope means in-scope

Techniques you cannot experience are excluded, with the rationale recorded. Reporting against all 697 is a vanity metric — it inflates the denominator with behaviours that could never affect you and makes every organisation look equally poor.

Status 3 expires

A validation result older than your review window drops to 2. A detection proven eighteen months ago, across two platform migrations and a schema change, is not proven now. A coverage metric that never decays rewards the year you ran a purple team exercise, indefinitely.

Why it matters

48.9%

Has detection logic

The industry-standard figure. Would pass unchallenged in most board packs.

12.7%

Actually proven

The same organisation, same scope, counting only what has been validated.

Both numbers describe the worked example. The gap between them is the entire argument for the model.

Report it alongside the domain scores, never instead of them. Coverage is one dimension. An organisation can have respectable validated coverage and no ability to act on what it detects.