---
title: "Stop counting MITRE techniques. Start closing the front door. | Guardian360"
description: "Attackers reuse a small, stable set of techniques, yet the industry sells \"100% MITRE coverage\". Why that metric reassures more than it protects, and where defensive effort actually earns its keep."
url: https://guardian360.net/blog/stop-counting-mitre-techniques-start-closing-the-front-door/
locale: en
source: guardian360.net
---
[← All posts](https://guardian360.net/blog)

Opinion

# Stop counting MITRE techniques. Start closing the front door.

By Jan Martijn Broekhof · 30 June 2026

A few weeks ago I sat in on the graduation presentation of an HBO Software Development student. The work was good, but it was a single point in his talk that stayed with me afterwards. He had been reading a 2024 study from NC State University, and he put a question to the room that I have not been able to shake since: if attackers keep reaching for the same small set of techniques, year after year, why does our entire industry insist on measuring something else?

It is a fair question, and the more I sat with it, the more uncomfortable it became. Because the honest answer is that we measure the wrong thing, we measure it badly, and we sell the result as reassurance.

## The arsenal is smaller than the marketing suggests

The study in question, “Attackers reveal their arsenal” by Rahman, Basak, Mahdavi Hezaveh and Williams, did something refreshingly concrete. The researchers took 667 cyber threat intelligence reports that MITRE ATT&CK cites, covering more than ten thousand documented techniques, and asked which ones actually recur.

The answer is sobering for anyone who imagines attackers as endlessly inventive. They identified nineteen prevalent techniques that together account for over a third of everything documented. Not one of those prevalent techniques was on a declining trend. The popular picture of the adversary as a restless innovator, forever inventing novel methods, does not survive contact with the evidence. Attackers are creatures of habit. They reuse what works, because what works keeps working.

You would think that this would be good news for defenders. A small, stable arsenal sounds like a problem you can get your arms around. And yet the way the industry has responded is to build an entire marketing language around covering all of it.

## So why does every vendor sell you “100% MITRE coverage”?

This is the question a CISO actually asks, usually somewhere between the second and third vendor demo. Every product claims comprehensive MITRE ATT&CK coverage. Every heatmap glows reassuringly green. And almost none of it means what the buyer thinks it means.

Independent analysis suggests that traditional security information and event management systems detect only around 21 percent of ATT&CK techniques on average, and that many of the headline coverage claims reflect endpoint-centric testing rather than the cloud, identity and SaaS surfaces where so many breaches now play out. The number on the slide and the protection in the environment are not the same thing.

Coverage is easy to sell because it is easy to draw. A matrix with most of the cells filled in looks like competence. Preventing an attacker from ever getting through the front door, by contrast, is invisible. Nobody photographs the breach that did not happen. So we have ended up rewarding the metric that demos well over the outcome that actually protects the organisation. That is coverage theatre, and we are all paying for tickets.

## The cruellest paradox: the most common techniques are the hardest to catch

Here is where the NC State study turns genuinely awkward. The researchers note that the most prevalent techniques look benign when viewed individually. Gathering system information, running a command shell, transferring a file: each of these is indistinguishable from ordinary, legitimate system activity. They only become an attack when you see them in sequence, and by then the actor is already inside.

This is not a theoretical worry. In the 2025 MITRE ATT&CK Evaluations, one of the test scenarios had to be dropped because the evaluators could not reliably separate the adversary’s legitimate-looking administrative actions from genuine ones, as Forrester reported afterwards. Read that again. MITRE itself, running a controlled test with full knowledge of what the attacker was doing, could not cleanly distinguish malicious from legitimate behaviour for these techniques.

So the techniques attackers use most are precisely the ones that resist detection most. The coverage heatmap promises to catch them. The evidence says even the people who designed the framework struggle to. We are not just measuring the wrong thing; we are claiming confidence about exactly the part of the problem that deserves the least.

## An honest admission, including about my own platform

At this point fairness demands that I turn the lens on myself. Guardian360 develops the Lighthouse platform, which does continuous vulnerability scanning, compliance recommendations against more than forty norms and laws, Microsoft 365 security insights, and intruder detection. If you took the nineteen prevalent techniques from the study and asked how many our platform prevents or reliably detects, the honest answer is: very few of them directly. Most of that arsenal is post-exploitation behaviour on the endpoint, and that is not what a vulnerability and compliance platform is built to watch.

I could dress that up. I will not. And here is the point that matters: no vendor can honestly claim to cover the whole chain either. The ones showing you a fully green matrix are not more capable than the rest of us. They are just less candid about where their product stops. A buyer is far better served by a supplier who says plainly what it does, what it does not, and where someone else is needed, than by one who has coloured in every cell and hopes you will not ask hard questions.

## Where the game is actually won: the front door

If the prevalent techniques are mostly things attackers do after they are inside, the obvious question is how they got inside in the first place. And on that, the data is unusually clear.

According to the Verizon 2025 Data Breach Investigations Report, exploitation of vulnerabilities has surged into second place among initial access vectors, present in 20 percent of breaches and up by 34 percent on the previous year. Stolen credentials account for 22 percent, and phishing sits at around 15 percent. The two or three ways attackers actually get in are all at the front of the chain, not buried in the post-exploitation techniques that fill the heatmaps. The study itself reaches the same conclusion from the other direction, naming spear-phishing as the most prevalent route to initial infection.

This is where defensive effort earns its keep. Patch the things that face the internet, especially the edge devices and VPNs that attackers now hit before the patch has even been deployed. Close the credential gaps. And on phishing, be honest about what training can and cannot do. The same Verizon report found that training barely moves the click rate, which stays stubbornly around 1.5 percent, but that trained employees report suspicious mail roughly four times more often. You will not train people into being unclickable. You can turn them into a fast human sensor network. That is a different and far more achievable goal.

None of this requires a wall of green cells. It requires deciding that keeping attackers out is worth more than being able to describe, in retrospect and in MITRE’s vocabulary, exactly how they moved once they were in.

## The question to ask next time

I am not arguing that detection does not matter. Assume-breach thinking exists for a good reason: prevention leaks, and a mature organisation needs to see the intruder who gets through anyway. But “assume breach” has quietly become a licence to underinvest in not being breached, and the coverage heatmap is the prop that makes that feel responsible.

So the next time a supplier shows you a MITRE matrix, do not ask how many techniques they detect. Ask which ones they prevent, ask what they honestly cannot do, and ask where your front door is still standing open. The arsenal is small and predictable. Our defences should start where the attacker does.

## Sources

- Rahman, Basak, Mahdavi Hezaveh & Williams (NC State University, 2024), “Attackers reveal their arsenal: An investigation of adversarial techniques in CTI reports”. [https://arxiv.org/abs/2401.01865](https://arxiv.org/abs/2401.01865)
- Verizon 2025 Data Breach Investigations Report, for the initial access vectors (vulnerability exploitation 20%, stolen credentials 22%, phishing around 15%) and the training reporting figures.
- Forrester (2025), analysis of the MITRE ATT&CK Evaluations 2025, on the scenario dropped because legitimate and malicious administrative actions could not be reliably distinguished.
- Mitiga, for the independent figure that traditional SIEM systems detect roughly 21% of ATT&CK techniques on average, and the critique of endpoint-centric “100% coverage” claims.
- MITRE ATT&CK Evaluations, for a neutral reference to what the evaluation is and is not.