Numbers Don’t Equal Coverage
Security vendors often promote “100% MITRE ATT&CK coverage.” The reality is most of those claims reflect endpoint-centric testing, not the attack surfaces organizations rely on most today: Cloud, SaaS, AI, and Identity.
That gap is where attackers thrive. And that’s where Mitiga stands apart.
The Cloud Gap
MITRE’s Enterprise matrix now spans more than 200 techniques, including dedicated matrices for Cloud platforms, SaaS, Identity Providers, and Office Suites. Yet very few detection and response vendors publish clear coverage numbers for those categories.
Independent research suggests that traditional SIEMs detect only about 21% of ATT&CK techniques on average. That leaves massive blind spots when attackers target SaaS accounts, cloud control planes, AI infrastructure, or identity systems.
Some of the most damaging breaches today, including malicious OAuth grants, API exfiltration, and compromised collaboration tools, play out entirely outside the endpoint.
Mitiga’s 80%
We measure ourselves against the techniques that matter for modern operations, not just the ones that are easy to catch. So, at Mitiga, our platform currently delivers
- 66 Cloud/SaaS/Identity techniques covered out of the box
- More than 80% of MITRE’s defined scope across Cloud, SaaS, and Identity
That means that when an attacker abuses a third-party integration in Salesforce, spins up shadow resources in AWS, or pivots from a compromised Okta account into GitHub, our detection framework is built to see it. Immediately.
What Leaders Should Ask
When you’re evaluating detection coverage, don’t stop at the headline percentage. Push for scope and evidence.
- Ask for the scope. Does the number include Cloud/SaaS techniques, or is it just endpoints?
- Look for technique-level mapping. Marketing numbers mean little without MITRE IDs.
- Demand transparency. Vendors should publish their ATT&CK version, included matrices, and definitions of “coverage.” Whether it could include telemetry, analytics, and response.
Without that clarity, you’re comparing apples to oranges. By leading with a scoped, documented percentage, we’re giving security teams something the market rarely provides: a verifiable view of their detection posture for the attack surfaces most at risk.
The Bottom Line
Cloud and SaaS attacks don’t look like endpoint attacks, and most tools still don’t cover them well. If your coverage claims don’t explicitly address these domains, you’re not measuring what matters.
At Mitiga, we’ll keep pushing our 80% higher, and we’ll keep publishing it. Because security teams deserve to know exactly what’s visible. And what isn’t.
See how your own coverage stacks up. Request a personalized demo and map your detections against the MITRE ATT&CK cloud and SaaS techniques that matter most.
