Overview

Read Security Posture Score and coverage from Detections → Overview.

The Overview tab is an executive-level dashboard that surfaces the most important metrics and action items from across all validation data.

Open Overview

  1. Go to Detections → Overview.

Security Posture Score

Detections Overview tab with Security Posture Score and Coverage Breakdown (dark mode)

The centerpiece of the Overview tab is the Security Posture Score, a single 0-100 metric displayed as a circular progress indicator. The score is color-coded by rating and computed from three weighted components:

Component

Weight

What It Measures

Attack Coverage

40%

The percentage of ATT&CK techniques that have been tested with meaningful defense outcomes, weighted by real-world threat prevalence (sourced from the Picus Red Report). Techniques observed more frequently in the wild carry more weight. Each test outcome is scored on a tier: Prevented (1.0), Responded (0.9), Detected (0.8), Alerted (0.6), Logged (0.3), Undetected (0.1).

Defense Coverage

35%

The percentage of D3FEND defensive controls that are Deployed or Validated. Controls in a Partial deployment state count as half.

Effective Defense

25%

Of the controls that are deployed, the percentage rated Effective or Highly Effective. Controls rated Partially Effective count as half.

Formula: (Attack Coverage x 0.4) + (Defense Coverage x 0.35) + (Effective Defense x 0.25)

The resulting score maps to a five-tier rating:

Rating

Score Range

Critical

0 - 24

Poor

25 - 39

Fair

40 - 59

Good

60 - 79

Excellent

80 - 100

If no validation data has been collected yet, the score displays as Not Assessed with a prompt to run a validation.

Coverage Breakdown

Beside the score widget, a horizontal bar chart provides a side-by-side comparison of the three component metrics — ATT&CK Coverage, D3FEND Deployment, and Defense Effectiveness — each shown as a percentage bar with summary statistics underneath.

Top Security Gaps

A table lists the highest-priority security gaps ranked by criticality, showing:

  • Technique - The ATT&CK technique ID and name
  • Tactic - The ATT&CK tactic category the technique belongs to
  • Missing Defenses - The count of D3FEND controls that are not effectively deployed for this technique
  • Risk Score - A 0-100 score factoring in prevalence weight, defense status, and test outcome
  • Priority - Critical, High, Medium, or Low

Clicking any row navigates directly to that technique in the Gap Analysis tab. A footer summarizes gap counts by tactic.

The Recommendations widget analyzes all current gaps and identifies which D3FEND techniques would provide the greatest coverage improvement if deployed. Recommendations are ranked by impact — the number of undefended ATT&CK techniques each D3FEND control would help cover. Each recommendation links to the official D3FEND documentation for the suggested technique.

MITRE ATT&CK, D3FEND, and EMB3D heatmaps are on Insights → Benchmarks, not on this page.

How Data Feeds Into Detections

Validation data comes from two primary sources:

  1. BAS Monitoring Sessions — Guard executes attack simulations and polls connected EDR/SIEM/NDR platforms (Microsoft Defender, CrowdStrike, SentinelOne, ExtraHop, Panther) for matching alerts. Detection matching uses rule-based filters (hostname, file hash, MITRE technique ID) with LLM-assisted classification as a fallback for ambiguous alerts.
  2. MITRE Framework Reference Data — Guard maintains curated datasets aligned to MITRE ATT&CK v14.1, D3FEND, and EMB3D, along with technique-to-control mappings and prevalence weights derived from the Picus Red Report. These datasets provide the structural backbone that validation results are scored and visualized against.

All scores, gap analyses, and recommendations are computed from the combination of these two sources — real test outcomes mapped against the full MITRE framework landscape.