IT and security / Free editable template

MITRE ATT&CK coverage map template

An ATT&CK coverage map shows where your detections are strong and where attackers could act unseen. This example takes eleven tactics from initial access to impact, lists common techniques under each and colours them by whether you detect them fully, partly or not at all, with the tool that does the detecting and a summary of the gaps.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the mitre att&ck coverage map

View full-size preview ↗
MITRE ATT&CK coverage map example showing eleven att&ck tactics, techniques coloured by detection coverage, coverage summary and next steps
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Pick relevant techniques

    Start with techniques used by the groups that target your sector, rather than trying to cover the whole framework at once.

  2. Rate your coverage honestly

    Mark a technique as detected only if you have tested the detection. Tools that could detect something do not count until proven.

  3. Close the gaps in order

    Work on the red tiles that matter most first, then retest the green ones with attack simulations.

Questions about this template

What do the colours on the technique cards show?

They show how well each technique is detected: fully, partly or not at all. The tool named on each card provides that coverage, and None marks a gap.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More IT and security templates →