Topic starter
09/07/2026 3:17 pm
TL;DR: MITRE ATT&CK grids are useful for research, but they do not answer the questions defenders actually ask about identity risk, exposed attack paths, or which accounts an attacker would target first, according to Abnormal AI. The real issue is that coverage language often hides practical attack exposure instead of measuring it.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “The Three Questions Your Identity Tool Won't Answer”.
Key questions
Q: Why is MITRE ATT&CK coverage not enough to assess identity risk?
A: Because ATT&CK shows technique coverage, not whether a real attack campaign would succeed in your environment.
Q: How should security teams evaluate identity attack exposure instead of coverage cells?
A: Start with the real attack you expect, then assess whether the target profile, account type, and access path exist in your environment.
Q: What are the signs that ATT&CK reporting is hiding identity risk?
A: A warning sign is when coverage reports are full of technique counts but cannot name the accounts, workflows, or campaign types most likely to be targeted.
Practitioner guidance
- Reframe coverage reports around real attack scenarios Replace technique-cell summaries with plain-language scenarios such as credential theft, help-desk takeover, and privilege-path abuse so leaders can see which attacks matter in their environment.
- Map attacker fit to specific identity populations Identify which user groups, reset workflows, and privileged accounts are most likely to be targeted first and score them by exposure and business reach.
- Test whether reported coverage changes defender decisions Ask whether a coverage claim would change account hardening, verification steps, or privileged workflow design.
Bottom line: ATT&CK coverage is useful for common adversary language, but it does not tell defenders which identity attacks are actually likely to work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:34 pm
ATT&CK coverage is a detection taxonomy, not a measure of identity risk. The framework is useful when teams need a shared language for adversary technique mapping, but it breaks down as soon as the question becomes which identities are actually exposed. A shaded matrix does not tell practitioners whether a help-desk reset, credential theft, or privilege path is reachable in their environment. The implication is that identity programmes need a separate exposure model, not a bigger ATT&CK grid.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between technique coverage and attack exposure?
A: Technique coverage asks whether a control maps to a known adversary method. Attack exposure asks whether that method can actually succeed against your identities, workflows, and privilege structure. Exposure is the operational question defenders need because it connects adversary behaviour to the accounts that would be hit first.
👉 Read our full editorial: MITRE ATT&CK coverage is not the same as attack risk