Skip to main content

Defense: Executive Risk And Coverage Report

Draft​

Level: Complex Platform Workflows

Goal: Produce an executive report showing threat relevance and coverage posture.

Real-Life Scenario​

A CISO asks for a non-technical view of which relevant threats are covered, which MITRE areas are weak, and what investments should come next.

When To Use This​

Use this workflow when you need an end-to-end platform workflow across multiple AdversaryGraph modules and want the output to remain traceable to evidence.

Steps​

  1. Select sector and environment context.
  2. Generate relevant actor and TTP view.
  3. Import current detection coverage layer.
  4. Compare threat-relevant TTPs to coverage.
  5. Identify top uncovered tactics and techniques.
  6. Summarize actor relevance without unsupported attribution.
  7. Add IOC and enrichment examples only when useful.
  8. Create visuals: matrix layer, coverage gap, actor list.
  9. Export PDF with assumptions, confidence, and next actions.
  10. Translate technical gaps into roadmap priorities.

Expected Result​

Executive-ready risk and MITRE coverage report with clear next actions.

Review Notes​

  • Keep source labels and evidence attached to every accepted result.
  • Treat actor matches, enrichment hits, and matrix overlap as analytical signals until corroborated.
  • Export only reviewed findings for customer, SOC, detection engineering, or executive use.

Platform Areas Used​

  • Operations / Pipeline
  • AI Analysis
  • ATT&CK Group Library
  • IOC Library
  • VirusTotal / OTX / ThreatFox / Malpedia enrichment where configured
  • Reference Sync
  • Navigator matrix
  • PDF, JSON, CSV, STIX, and Navigator exports as needed