The Validated Coverage Score

The Validated Coverage Score replaces “percentage of ATT&CK covered” with a number that distinguishes a rule that exists from a detection proven to fire — computed only over the techniques you scoped as genuinely relevant.

The four statuses

VCS = achieved points / (3 × in-scope techniques)

Two rules make it meaningful

In-scope means in-scope

Techniques you cannot experience are excluded, with the rationale recorded. Reporting against all 697 is a vanity metric — it inflates the denominator with behaviours that could never affect you and makes every organisation look equally poor.

Status 3 expires

A validation result older than your review window drops to 2. A detection proven eighteen months ago, across two platform migrations and a schema change, is not proven now. A coverage metric that never decays rewards the year you ran a purple team exercise, indefinitely.

How the browser tool records it

Since model 1.6.0 the assessment tool carries a per-technique detection register (step 7) and reads it with exactly these four statuses, in this order: a technique with no deployed / not deployed answer is not assessed and is never turned into a 0 or a 1, even where telemetry assurance reports it as blind (the two findings are shown side by side); with an answer, telemetry reach of 0% on the telemetry step is status 0, and a detection recorded against such a technique is flagged, because it cannot fire. Status 2 needs a deployed, enabled detection whose required telemetry is healthy and a named evidence artefact. Status 3 needs a validation date inside the stated recency window, a qualifying controlled adversarial method — atomic test, adversary emulation, purple-team exercise, breach and attack simulation, red-team exercise, or a penetration test where the exact behaviour and the resulting detection are evidenced — and an outcome of fired. A production true positive is recorded as operational evidence and stays at 2, because the model defines 3 as validation by adversarial emulation; an unreviewed “other” method also stays at 2. The score is reported only when every in-scope technique has an answer, because the denominator is the in-scope set. Nothing earns a 2 or a 3 from a vendor claim, an ATT&CK Evaluations result, a high maturity score, a rule name without an artefact, or empty evidence fields. The detection step.

Why it matters

Both numbers describe the worked example. The gap between them is the entire argument for the model.

Common questions

What is the Validated Coverage Score?

The Validated Coverage Score measures what proportion of an organisation's in-scope ATT&CK techniques have detection that has been proven to fire, rather than merely deployed. Each technique scores 0 for no telemetry, 1 for telemetry only, 2 for deployed detection logic and 3 for validation observed within a recency window. VCS is the achieved points divided by three times the in-scope technique count.