Before your ATT&CK coverage heatmap goes into a customer questionnaire under your signature, what do you change?

## The same grid means two different things on two sides of the door Inside the SOC, a coverage heatmap is a planning artefact. Green means "we have done what we are going to do here for now"; red means "work item"; the colours are shorthand among people who know how they were assigned and who will happily argue about any of them. It is allowed to be rough because everyone who reads it can ask its author a question. The moment it goes to a customer under a signature, all of that context is stripped. The reader is an assurance or procurement analyst with no access to the person who coloured it. They will read green as "they would detect that", file it, and possibly reference it in a contract schedule. And if there is ever an intrusion involving one of those techniques, the same document is read backwards, by people asking what you claimed and when. So the question is not whether the heatmap is *accurate*. It is whether every cell is a claim you would defend a year later with the person who made it gone. ### What to change, concretely **State the basis per cell, or take the colour off.** Externally, a colour with no stated basis is the whole problem. Each cell that stays coloured should carry what the colour asserts - source collected, rule in production, behaviour executed and detected - and the date. A cell that cannot carry that loses its colour rather than keeping it on trust. **Scope it to the estate the customer actually touches.** A company-wide figure is not what they are asking for even when it is what they asked for. If their data lives in one tenant, one region, or on one platform, the claim should be about that population of hosts and that identity boundary. An aggregate that averages a well-instrumented endpoint fleet with an un-instrumented platform is misleading in exactly the direction that benefits you. **Refuse the single number.** One percentage cannot be true across platforms, and it invites the reader to compare it with another vendor's differently computed number. If a number is unavoidable, give it with its denominator, its date, and the count of cells excluded from it. **Downgrade what you cannot defend, deliberately.** This is the substance of the exercise. A cell you believe but cannot evidence goes down a level. A cell that depends on a log source you are not actually collecting across that population goes down further. Doing this before the document leaves is a decision; doing it after an incident is a retraction. **Convert what you will not fix into an accepted blind spot.** Some gaps will not close - the platform cannot be instrumented within the budget, or the cost is genuinely disproportionate to the risk. The honest form of that is not a colour. It is a named gap with the missing source, an accountable owner, the compensating controls at other layers, a decision date and a review date. That record is defensible in front of a customer and in front of an investigator, because it shows the organisation knew, decided, and was watching the decision. **Decide what you are not disclosing, and say so.** Some detail is genuinely sensitive - naming precisely which behaviours you cannot see is an aid to an attacker who reads the questionnaire. Withholding is a legitimate position. Colouring the cell green instead is not, because it converts a refusal into a false statement. A withheld cell, disclosed as withheld under whatever the contract permits, keeps the artefact honest. **Version it and agree who re-signs it.** Coverage decays: sensors get uninstalled, rules break on schema changes, the estate grows platforms. A signed claim with no expiry becomes a false claim by attrition. Attach a version, keep the superseded ones, and agree a cadence for re-attestation. ### The judgement the question is really testing The pressure here is never technical. Sales wants the grid greener; the customer wants one number; the SOC knows most cells are level-one claims. The position that survives is that a downgraded, dated, owned artefact is worth more to the organisation than a green one, because it is the version that still stands after an incident - and the person signing it is the one who has to say so to people who would rather hear something else. Interviewers ask this to find out whether you will hold that line when the artefact leaves your control, or whether you will let the audience choose the colours.