Headline figure
60%
average ATT&CK coverage in 2026, up from 45% in 2025
Source: SOC Maturity Report 2026, SOC-CMM® (CC BY-SA 4.0), soc-cmm.com. ATT&CK coverage, Detection validation and Threat modelling sections.
MITRE ATT&CK coverage: 2026 SOC-CMM statistics
MITRE ATT&CK coverage in 2026: the average rises from 45% to 60% and 45% of SOCs are on par with their targets, per the 2026 SOC Maturity Report.
Executive reading
Average MITRE ATT&CK technique coverage rises from 45% in 2025 to 60% in 2026, a notable jump in a single year. 45% of respondents also state their current coverage is on par with their targets. The report confirms that almost all SOCs use ATT&CK as a central resource for threat modelling, detection engineering and defensive gap analysis, and qualifies the ceiling: 100% coverage is usually interpreted as relevant or technically feasible coverage, because some techniques execute outside the organization and have little to no data sources.
What does this mean for your SOC? The market bar has risen: 45% coverage, the 2025 average, is below average in 2026. But coverage does not equal effectiveness. Maturity appears when the matrix connects to real telemetry, maintained rules, periodic validation and risk-based prioritization. One partner insight in the report is revealing: globally, only about half of ingested telemetry is used for detection. Before chasing more techniques, exploit the data you already pay for. How to measure this with the model is detailed in MITRE ATT&CK coverage in SOC-CMM.
Report data
| Metric | Value | Reading |
|---|---|---|
| 2026 average coverage | 60% | Up from 45% in 2025. |
| On par with targets | 45% | According to report responses. |
| MITRE ATT&CK profiling | 58% | Most widespread threat modelling activity. |
| Attack surface analysis | 43% | +95% YoY; the largest growth. |
| Threat-based detections | 43% | +20% YoY; operational use. |
| Ingested telemetry used for detection | ~50% | Partner insight (Kaspersky) in the report. |
Analysis and context
Methodology: the figures come from the 2026 SOC Maturity Report survey (late January to mid-March 2026; 290 responses, roughly 200 retained after cleaning). The report warns that the dataset skews toward SOCs already invested in maturity, so average coverage across the broader market is probably below the reported 60%.
In threat modelling, MITRE ATT&CK profiling remains the most widespread activity (58%), followed by vulnerability analysis (45%, +48%) and threat-based detections (43%, +20%). The largest year-over-year growth is attack surface analysis, which nearly doubles (+95%) to 43%, a movement the report associates with the adoption of threat exposure management approaches.
In detection validation, most SOCs combine several strategies: testing before moving to production as the base, complemented with purple teaming, atomic red teaming, data source ingestion status monitoring and breach and attack simulation tooling. Validation is what turns a coverage heatmap into a number you can defend before the board; without it, the percentage is a hypothesis. An independent SOC-CMM assessment reviews exactly that full chain, from telemetry to validated rule.
What to do with this data
- Define relevant techniques.
- Map sources by technique.
- Validate rules before production.
- Measure coverage against targets, not the whole ATT&CK framework.
- Audit how much ingested telemetry feeds real detections.