[{"data":1,"prerenderedAt":1327},["ShallowReactive",2],{"page-\u002Fthreat-report\u002Funderstanding-coverage":3,"navigation":1010},{"id":4,"title":5,"body":6,"description":994,"extension":995,"meta":996,"navigation":1005,"path":1006,"seo":1007,"stem":1008,"__hash__":1009},"docs\u002F04.threat-report\u002F03.understanding-coverage.md","Understanding Coverage and Gaps",{"type":7,"value":8,"toc":973},"minimark",[9,13,27,50,53,58,81,94,101,130,137,139,143,150,173,184,298,307,325,339,341,345,356,401,412,420,422,426,433,438,447,483,487,496,509,513,531,535,542,565,577,581,604,606,610,621,729,733,743,751,772,784,792,794,798,805,839,850,852,856,863,913,926,928,932],[10,11,5],"h1",{"id":12},"understanding-coverage-and-gaps",[14,15,16,17,21,22,26],"p",{},"The ",[18,19,20],"strong",{},"Coverage & Gaps"," tab is the deepest surface in the Threat Report. It answers one question for a security analyst: ",[23,24,25],"em",{},"for my model's live threats, which MITRE ATT&CK techniques are countered, how strongly, and where are the gaps?"," This guide helps you read the matrix correctly — and, just as importantly, helps you avoid over-claiming what it shows.",[14,28,29,30,33,34,38,39,44,45,49],{},"The tab is powered by the ",[18,31,32],{},"Coverage Tools"," module. If that module is not deployed for your instance, the tab tells you so (",[35,36,37],"code",{},"Coverage facts are unavailable…",") and the rest of the report is unaffected. See ",[40,41,43],"a",{"href":42},"\u002Fthreat-report\u002Fgetting-started","Getting Started"," for the prerequisite. For the shared visual language and the technique dialog this tab reuses, see ",[40,46,48],{"href":47},"\u002Fthreat-report\u002Freading-the-report","Reading the Report",".",[51,52],"hr",{},[54,55,57],"h2",{"id":56},"what-the-matrix-shows-and-what-it-does-not","What the Matrix Shows — and What It Does Not",[14,59,60,61,64,65,68,69,72,73,76,77,80],{},"The matrix charts your model's ",[18,62,63],{},"live"," (untriaged ",[18,66,67],{},"or"," affirmed) exposures against the MITRE ATT&CK techniques they map to. Each ",[18,70,71],{},"row"," is a technique that one or more of your exposures actually exploits; each ",[18,74,75],{},"column"," is a tactic those techniques reach. An ",[18,78,79],{},"affirmed"," exposure is a reviewed-and-confirmed risk, so it stays on the live grid; only the muting dispositions take an exposure off it.",[82,83,84],"blockquote",{},[14,85,86,89,90,93],{},[18,87,88],{},"This is not the full ATT&CK matrix."," It shows only the techniques your model's exposures map to — never the entire framework. A technique you don't see is one your model doesn't currently expose, not a silent gap. Gaps that the model ",[23,91,92],{},"does"," expose appear as uncovered cells; gaps it can't chart appear in the off-grid notes below the controls.",[14,95,96,97,100],{},"What the matrix deliberately does ",[18,98,99],{},"not"," claim:",[102,103,104,111,117],"ul",{},[105,106,107,110],"li",{},[18,108,109],{},"No coverage percentage."," There is no \"73% covered\" number anywhere on this surface, by design.",[105,112,113,116],{},[18,114,115],{},"No single \"Covered: N\" total."," Coverage is shown tier by tier and function by function, never rolled into one headline figure.",[105,118,119,122,123,126,127,129],{},[18,120,121],{},"No proof of effectiveness."," The data is ",[23,124,125],{},"modeled \u002F design-asserted"," coverage, not deployed telemetry. \"Covered\" means a real control supports the exposed element and counters the technique — it does ",[18,128,99],{}," prove that control works in production.",[14,131,16,132,136],{},[40,133,135],{"href":134},"#talking-about-coverage-honestly","next section on talking to stakeholders"," explains why these omissions are features, not gaps.",[51,138],{},[54,140,142],{"id":141},"how-to-read-a-cell","How to Read a Cell",[14,144,145,146,149],{},"The grid is ",[18,147,148],{},"monochrome"," on purpose. Color is reserved for severity elsewhere in the report; here, color would invite a \"traffic-light\" misreading. Each cell carries at most two signals:",[102,151,152,162],{},[105,153,16,154,157,158,161],{},[18,155,156],{},"fill"," encodes the coverage ",[18,159,160],{},"tier"," — how specific the strongest covering control is.",[105,163,164,165,168,169,172],{},"A single ",[18,166,167],{},"glyph"," encodes the security ",[18,170,171],{},"function"," — whether you can prevent the technique or only detect it.",[14,174,175,176,179,180,183],{},"Turn on the ",[18,177,178],{},"Legend"," toggle (the ",[35,181,182],{},"▸ Legend"," button in the controls row) to see this encoding inline at any time. It expands to:",[185,186,192],"div",{"className":187,"tabIndex":189,"role":190,"ariaLabel":191},[188],"table-frame",0,"region","Table: How to Read a Cell",[193,194,195,211],"table",{},[196,197,198],"thead",{},[199,200,201,205,208],"tr",{},[202,203,204],"th",{},"Cell",[202,206,207],{},"Tier \u002F state",[202,209,210],{},"Reading",[212,213,214,228,241,254,267,281],"tbody",{},[199,215,216,220,225],{},[217,218,219],"td",{},"Full solid fill",[217,221,222],{},[35,223,224],{},"DIRECT",[217,226,227],{},"Author-asserted coverage — the strongest, most specific tier.",[199,229,230,233,238],{},[217,231,232],{},"Mid fill",[217,234,235],{},[18,236,237],{},"Mitigation",[217,239,240],{},"Coverage via a catalogue-precise ATT&CK mitigation.",[199,242,243,246,251],{},[217,244,245],{},"Hatch texture",[217,247,248],{},[18,249,250],{},"D3FEND",[217,252,253],{},"Broad, inferred coverage via a shared defensive artifact.",[199,255,256,259,264],{},[217,257,258],{},"Empty dotted cell",[217,260,261],{},[35,262,263],{},"UNCOVERED",[217,265,266],{},"The technique is exploited here, but no covering control supports the element.",[199,268,269,275,278],{},[217,270,271,274],{},[35,272,273],{},"⛉"," glyph",[217,276,277],{},"prevent",[217,279,280],{},"At least one preventive control survives at some tier.",[199,282,283,288,291],{},[217,284,285,274],{},[35,286,287],{},"◎",[217,289,290],{},"detect",[217,292,293,294,297],{},"The technique is covered, but ",[18,295,296],{},"detect-only"," — no preventive edge anywhere.",[14,299,300,301,303,304,306],{},"So a full-fill cell with a ",[35,302,273],{}," reads \"DIRECT, preventive — your strongest result.\" A hatched cell with a ",[35,305,287],{}," reads \"broad inferred coverage, and you can only see the technique, not stop it.\" An empty dotted cell with no glyph is a true gap.",[82,308,309],{},[14,310,311,314,315,317,318,320,321,324],{},[18,312,313],{},"Detect-only is a reduction, not an oversight."," A ",[35,316,287],{}," with no ",[35,319,273],{}," means: a control covers this technique, but every covering edge is detective. You can ",[23,322,323],{},"see it, but not stop it."," Treat detect-only the same way you treat an uncovered cell when you prioritize work — both belong on the worklist.",[14,326,327,328,331,332,335,336,338],{},"Hover any cell, technique id, or ",[18,329,330],{},"Best"," label for a one-line summary in the tooltip — for example ",[35,333,334],{},"T1059 · Command and Scripting Interpreter — DIRECT-prevent · covered for 3 of 4 element(s) · 1 UNCOVERED",". The rightmost ",[18,337,330],{}," column states each technique's strongest result in words, so you can read the row without decoding the cell.",[51,340],{},[54,342,344],{"id":343},"the-three-tiers-and-why-they-are-never-blended","The Three Tiers — and Why They Are Never Blended",[14,346,347,348,351,352,355],{},"A technique is ",[18,349,350],{},"covered for an exposure"," only when a real countermeasure's parent control actually supports the exposed element. All three tiers are real coverage; they differ in ",[23,353,354],{},"specificity",", not in whether the control exists.",[185,357,360],{"className":358,"tabIndex":189,"role":190,"ariaLabel":359},[188],"Table: The Three Tiers — and Why They Are Never Blended",[193,361,362,372],{},[196,363,364],{},[199,365,366,369],{},[202,367,368],{},"Tier",[202,370,371],{},"What it means for you",[212,373,374,383,392],{},[199,375,376,380],{},[217,377,378],{},[35,379,224],{},[217,381,382],{},"The control's author asserted, explicitly, that it counters this technique. The most trustworthy, most specific signal.",[199,384,385,389],{},[217,386,387],{},[18,388,237],{},[217,390,391],{},"The control maps to an ATT&CK mitigation that defends against this technique. Catalogue-precise, one inference removed from DIRECT.",[199,393,394,398],{},[217,395,396],{},[18,397,250],{},[217,399,400],{},"The control shares a defensive artifact with the technique. Broad and inferred — useful as a signal, weak as a guarantee.",[14,402,403,404,407,408,411],{},"The matrix ",[18,405,406],{},"never blends these into one number",", and the broad D3FEND tier is drawn as a distinct ",[18,409,410],{},"hatch texture"," rather than a fainter shade of the same fill. That choice is deliberate: a fainter shade would let \"broad, inferred\" masquerade as \"a little bit covered\" and quietly inflate a glance-read of the grid. The hatch keeps D3FEND visually separate so you always know when a cell rests on the weakest tier.",[82,413,414],{},[14,415,416,419],{},[18,417,418],{},"When you cite coverage, name the tier."," \"DIRECT-prevent on the auth service\" is a defensible claim. \"Covered\" — unqualified — flattens a DIRECT result and a broad D3FEND inference into the same word. The matrix refuses to do that, and so should you.",[51,421],{},[54,423,425],{"id":424},"filtering-and-focusing","Filtering and Focusing",[14,427,428,429,432],{},"The controls row above the grid, plus the clickable tactic headers, let you narrow the matrix to exactly what you're working on. The filters ",[18,430,431],{},"compose"," — a tier filter, the worklist toggle, and a tactic column filter all apply together.",[434,435,437],"h3",{"id":436},"the-tier-filter","The Tier filter",[14,439,16,440,442,443,446],{},[18,441,368],{}," dropdown partitions the rows by each technique's ",[23,444,445],{},"best"," tier, so the options sum to the whole grid:",[102,448,449,455,461,467,477],{},[105,450,451,454],{},[35,452,453],{},"all"," — every charted technique.",[105,456,457,460],{},[35,458,459],{},"DIRECT only"," — techniques whose strongest coverage is DIRECT.",[105,462,463,466],{},[35,464,465],{},"Mitigation only"," — best tier is Mitigation.",[105,468,469,472,473,476],{},[35,470,471],{},"D3FEND only"," — best tier is the broad D3FEND tier. ",[18,474,475],{},"Scan this list when auditing"," — these techniques rest on the weakest inference.",[105,478,479,482],{},[35,480,481],{},"uncovered"," — techniques with no covering control at all.",[434,484,486],{"id":485},"the-uncovered-detect-only-worklist","The uncovered + detect-only worklist",[14,488,16,489,492,493,495],{},[18,490,491],{},"uncovered + detect-only"," toggle is your \"fund a control\" worklist. It reduces the grid to techniques that are either uncovered or detect-only — every technique where you currently cannot ",[23,494,277],{}," the attack. This is the shortlist to act on.",[82,497,498],{},[14,499,500,501,504,505,508],{},"If this toggle empties the grid, you'll see ",[35,502,503],{},"No uncovered or detect-only techniques on the live grid — every charted technique has a preventive control."," Read it precisely: it speaks only to the ",[18,506,507],{},"charted"," grid. The off-grid items below — unmapped exposures, Data, and structural gaps — still apply. A clean grid is not an all-clear.",[434,510,512],{"id":511},"clickable-tactic-columns","Clickable tactic columns",[14,514,515,516,519,520,523,524,527,528,49],{},"Each ",[18,517,518],{},"tactic column header"," is a toggle. Click a header (for example ",[18,521,522],{},"Initial Access",") to filter the rows to techniques in that tactic; the header shows a ",[35,525,526],{},"✕"," and clicking it again clears the filter. Use this to ask \"where do my gaps cluster by attacker objective?\" — combine it with the worklist toggle to see, say, every detect-only technique under ",[18,529,530],{},"Lateral Movement",[434,532,534],{"id":533},"expanding-a-techniques-elements","Expanding a technique's elements",[14,536,537,538,541],{},"Each row names the ",[18,539,540],{},"element(s)"," the technique impacts:",[102,543,544,555],{},[105,545,546,547,550,551,554],{},"A ",[18,548,549],{},"single-element"," technique shows that element inline as a drill link. A leading ",[35,552,553],{},"✓"," marks it covered.",[105,556,546,557,560,561,564],{},[18,558,559],{},"multi-element"," technique collapses to a count, such as ",[35,562,563],{},"4 elements · 3 covered",". Click the row's caret (or the count) to expand the full list. Uncovered elements are listed first, so the actionable ones lead; covered elements are muted.",[14,566,567,568,571,572,576],{},"Every element name is a link to its ",[18,569,570],{},"Component Profile"," — click it to drill into that element's findings and supporting controls. See ",[40,573,575],{"href":574},"\u002Fthreat-report\u002Fworking-with-findings","Working with Findings"," for the profile.",[434,578,580],{"id":579},"the-technique-dialog","The technique dialog",[14,582,583,584,587,588,591,592,595,596,599,600,603],{},"A bare technique id like ",[35,585,586],{},"T1078"," is opaque. Click the ",[18,589,590],{},"ⓘ"," next to any technique id to open the shared technique dialog, which shows the technique's ",[18,593,594],{},"name",", its ",[18,597,598],{},"tactics",", and a cleaned ATT&CK ",[18,601,602],{},"description",". It's the same dialog used elsewhere in the report, so the affordance is identical everywhere.",[51,605],{},[54,607,609],{"id":608},"reading-the-off-grid-notes-honestly","Reading the Off-Grid Notes Honestly",[14,611,612,613,616,617,620],{},"Below the controls sits an ",[18,614,615],{},"Off-grid"," summary line. Its counts are ",[18,618,619],{},"always visible"," — they are the completeness note that keeps the grid from reading as a false all-clear. Click the line to expand the detail. There are four categories, and each exists because charting it as \"covered\" or \"uncovered\" would mislead you.",[185,622,625],{"className":623,"tabIndex":189,"role":190,"ariaLabel":624},[188],"Table: Reading the Off-Grid Notes Honestly",[193,626,627,640],{},[196,628,629],{},[199,630,631,634,637],{},[202,632,633],{},"Off-grid category",[202,635,636],{},"What it means",[202,638,639],{},"How to treat it",[212,641,642,660,681,698],{},[199,643,644,650,653],{},[217,645,646,649],{},[18,647,648],{},"unmapped"," (soft)",[217,651,652],{},"Live exposures with no ATT&CK mapping.",[217,654,655,656,659],{},"Coverage ",[18,657,658],{},"can't be assessed"," for them. They are neither a covered win nor a grid gap — just unchartable.",[199,661,662,667,674],{},[217,663,664],{},[18,665,666],{},"Data-mapped",[217,668,669,670,673],{},"Exposures on ",[18,671,672],{},"Data"," elements.",[217,675,676,677,680],{},"Kept off the grid: most models put a data item's protection on the elements that ",[23,678,679],{},"handle"," it, so charting Data would show rows that never read as covered. Their techniques are still disclosed, with any controls applied to the data item itself (see below).",[199,682,683,688,691],{},[217,684,685],{},[18,686,687],{},"structural gap",[217,689,690],{},"An element class with zero supporting controls anywhere in the model.",[217,692,693,694,697],{},"One honest completeness line — for example ",[35,695,696],{},"No control in this model supports any component"," — not a flood of per-technique cells. A maturity gap, not a single missing control.",[199,699,700,705,711],{},[217,701,702],{},[18,703,704],{},"excluded",[217,706,707,710],{},[18,708,709],{},"Muted"," exposures — those given a muting disposition.",[217,712,713,714,717,718,721,722,725,726,728],{},"Excluded from the live grid but ",[18,715,716],{},"counted",", never silently dropped. They still appear in the ",[18,719,720],{},"Residual Risk"," ledger. ",[18,723,724],{},"Affirmed"," findings are ",[23,727,99],{}," excluded — they stay live and remain charted on the grid; only the muting dispositions land here.",[434,730,732],{"id":731},"data-exposures-off-the-grid-but-disclosed","Data exposures: off the grid, but disclosed",[14,734,735,736,738,739,742],{},"Data exposures are charted nowhere on the grid — but their ATT&CK mapping is a real fact about the exposure, so the report still discloses it. Expand the ",[18,737,666],{}," line to reveal one row per Data element, each with its technique chips and, when the data item has any, the controls applied to it, listed by name after ",[35,740,741],{},"controls:",". The element name drills to its profile; each chip opens the technique dialog.",[82,744,745],{},[14,746,747,750],{},[18,748,749],{},"A Data control is listed, not graded."," A control you apply to a data item shows beside that data item as assigned, with no coverage tier. It does not count toward the coverage of the elements that handle the data item, and their controls do not count toward the data item.",[82,752,753],{},[14,754,755,762,763,765,766,768,769,49],{},[18,756,757,758,761],{},"The profile's ",[35,759,760],{},"⛉ uncovered"," flag is not a grade either."," In a data item's Component Profile, its open exposures carry the ",[35,764,760],{}," flag when no control is applied to the data item, exactly as on any other element; once a control is applied, the flag is gone. It marks \"no control applied,\" not a coverage result, and it is a different thing from the grid's ",[35,767,273],{}," prevent glyph. See ",[40,770,575],{"href":771},"\u002Fthreat-report\u002Fworking-with-findings#exposures",[82,773,774],{},[14,775,776,779,780,783],{},[18,777,778],{},"A Data chip is identity, not coverage."," Because these techniques are off-grid, the chips carry no tier fill and no glyph. A chip tells you ",[23,781,782],{},"which"," technique the Data exposure maps to — never that it is covered or uncovered. Don't read a present chip as a win.",[82,785,786],{},[14,787,788,791],{},[18,789,790],{},"Why off-grid matters."," If you only read the grid, you'd miss live threats that aren't charted there — those that can't be, and Data, which is kept off by choice. The off-grid counts force those into view: an exposure with no mapping, or on Data, is still a live exposure in your model. The grid is honest precisely because it admits what it doesn't chart.",[51,793],{},[54,795,797],{"id":796},"talking-about-coverage-honestly","Talking About Coverage Honestly",[14,799,800,801,804],{},"The most important thing this surface does is refuse to produce a flattering aggregate. Keep these caveats with you whenever you report coverage results. The ",[18,802,803],{},"ⓘ Modeled coverage"," toggle in the controls row spells them out on screen, and the same wording rides into every export footer.",[102,806,807,817,823,829],{},[105,808,809,812,813,816],{},[18,810,811],{},"Coverage is modeled, not measured."," It reflects controls ",[23,814,815],{},"asserted in your model",", not telemetry from a running system. \"Covered\" means a control is wired to counter the technique at some tier — it is a design claim, not evidence of effectiveness.",[105,818,819,822],{},[18,820,821],{},"There is no percentage and no single total."," This is intentional. A percentage invites a screenshot that says \"we're 80% covered,\" which blends DIRECT certainty with broad D3FEND inference and hides detect-only gaps. The tier-by-tier, function-by-function presentation can't be flattened into that one number.",[105,824,825,828],{},[18,826,827],{},"Name the tier and the function."," Report \"DIRECT-prevent for 3 of 4 elements on technique T1059,\" not \"T1059 is covered.\" The qualified statement is the honest one.",[105,830,831,834,835,838],{},[18,832,833],{},"Off-grid items are part of the story."," When you brief, mention the unmapped, Data, and structural-gap counts. They are exposures your coverage view ",[23,836,837],{},"can't"," speak to, and omitting them recreates the false all-clear the design works to prevent.",[82,840,841],{},[14,842,843,846,847,849],{},[18,844,845],{},"A clean grid is not a clean model."," An empty worklist means every ",[23,848,507],{}," technique has a preventive control. It says nothing about unmapped exposures, Data-level threats, structural gaps, or whether any of those controls actually function in production. Always read the off-grid line alongside the grid.",[51,851],{},[54,853,855],{"id":854},"acting-on-gaps","Acting on Gaps",[14,857,858,859,862],{},"Use the matrix to decide ",[23,860,861],{},"where to invest in controls",", in this order:",[864,865,866,872,889,898,907],"ol",{},[105,867,868,871],{},[18,869,870],{},"Turn on the uncovered + detect-only worklist."," This is your prevention shortlist — every technique you cannot currently stop.",[105,873,874,877,878,881,882,885,886,49],{},[18,875,876],{},"Sort by attacker objective."," Click the tactic headers to see where gaps cluster. A wall of uncovered cells under ",[18,879,880],{},"Impact"," or ",[18,883,884],{},"Exfiltration"," is a different conversation than scattered gaps under ",[18,887,888],{},"Discovery",[105,890,891,894,895,897],{},[18,892,893],{},"Drill to the element."," Expand a technique and click an uncovered element to open its ",[18,896,570],{},", where you can see what controls it already has and what's missing.",[105,899,900,903,904,906],{},[18,901,902],{},"Audit your weakest wins."," Switch the Tier filter to ",[35,905,471],{},". These are \"covered\" only by broad inference — candidates to reinforce with a more specific control.",[105,908,909,912],{},[18,910,911],{},"Close structural gaps deliberately."," A structural-gap line means an entire element class has no controls anywhere. That's a maturity decision, not a single fix — plan it as program work.",[14,914,915,916,919,920,923,924,49],{},"Adding or mapping a control changes the model, which makes the report ",[18,917,918],{},"stale",". Add or adjust the control through the normal controls workflow, then ",[18,921,922],{},"Recreate"," the snapshot to fold the change into a fresh coverage view. For recording decisions on findings (and how disposition removes an exposure from the live grid while keeping it in Residual Risk), see ",[40,925,575],{"href":574},[51,927],{},[54,929,931],{"id":930},"related-guides","Related Guides",[102,933,934,941,948,957,964],{},[105,935,936,940],{},[18,937,938],{},[40,939,43],{"href":42}," — generating, refreshing, and exporting the report; the Coverage Tools prerequisite.",[105,942,943,947],{},[18,944,945],{},[40,946,48],{"href":47}," — the shared visual language and the technique dialog.",[105,949,950,956],{},[18,951,952],{},[40,953,955],{"href":954},"\u002Fthreat-report\u002Freachability","Reachability"," — which crown jewels modeled flow routes lead to.",[105,958,959,963],{},[18,960,961],{},[40,962,575],{"href":574}," — the Residual Risk ledger, recording decisions, and the Component Profile.",[105,965,966,972],{},[18,967,968],{},[40,969,971],{"href":970},"\u002Fthreat-report","Guide Index"," — the full Threat Report documentation set.",{"title":974,"searchDepth":975,"depth":975,"links":976},"",3,[977,979,980,981,988,991,992,993],{"id":56,"depth":978,"text":57},2,{"id":141,"depth":978,"text":142},{"id":343,"depth":978,"text":344},{"id":424,"depth":978,"text":425,"children":982},[983,984,985,986,987],{"id":436,"depth":975,"text":437},{"id":485,"depth":975,"text":486},{"id":511,"depth":975,"text":512},{"id":533,"depth":975,"text":534},{"id":579,"depth":975,"text":580},{"id":608,"depth":978,"text":609,"children":989},[990],{"id":731,"depth":975,"text":732},{"id":796,"depth":978,"text":797},{"id":854,"depth":978,"text":855},{"id":930,"depth":978,"text":931},"Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean","md",{"category":997,"position":998,"tags":999},"documentation",4,[1000,1001,1002,1003,1004],"threat-report","coverage","mitre","attack","gaps",true,"\u002Fthreat-report\u002Funderstanding-coverage",{"title":5,"description":994},"04.threat-report\u002F03.understanding-coverage","rogi6y5g2sGCjTv5wMsdekHkStEeGX4Qptn-I92-0KE",[1011,1066,1101,1156,1179,1222,1237,1307],{"title":1012,"description":1013,"path":1014,"stem":1015,"children":1016,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1017,1021,1026,1031,1036,1041,1046,1051,1056,1061],{"title":1018,"path":1014,"stem":1019,"description":1020},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1022,"path":1023,"stem":1024,"description":1025},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1027,"path":1028,"stem":1029,"description":1030},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1032,"path":1033,"stem":1034,"description":1035},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1037,"path":1038,"stem":1039,"description":1040},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1042,"path":1043,"stem":1044,"description":1045},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1047,"path":1048,"stem":1049,"description":1050},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1052,"path":1053,"stem":1054,"description":1055},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1057,"path":1058,"stem":1059,"description":1060},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1062,"path":1063,"stem":1064,"description":1065},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1067,"description":1068,"path":1069,"stem":1070,"children":1071,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1072,1076,1081,1086,1091,1096],{"title":1073,"path":1069,"stem":1074,"description":1075},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1077,"path":1078,"stem":1079,"description":1080},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1082,"path":1083,"stem":1084,"description":1085},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1087,"path":1088,"stem":1089,"description":1090},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1092,"path":1093,"stem":1094,"description":1095},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1097,"path":1098,"stem":1099,"description":1100},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1102,"description":1103,"path":1104,"stem":1105,"children":1106,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1107,1111,1116,1121,1126,1131,1136,1141,1146,1151],{"title":1108,"path":1104,"stem":1109,"description":1110},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1112,"path":1113,"stem":1114,"description":1115},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1117,"path":1118,"stem":1119,"description":1120},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1122,"path":1123,"stem":1124,"description":1125},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1127,"path":1128,"stem":1129,"description":1130},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1132,"path":1133,"stem":1134,"description":1135},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1137,"path":1138,"stem":1139,"description":1140},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1142,"path":1143,"stem":1144,"description":1145},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1147,"path":1148,"stem":1149,"description":1150},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1152,"path":1153,"stem":1154,"description":1155},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1157,"description":1158,"path":970,"stem":1159,"children":1160,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[1161,1164,1168,1171,1172,1176],{"title":1157,"path":970,"stem":1162,"description":1163},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1165,"path":42,"stem":1166,"description":1167},"Getting Started with the Threat Report","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":48,"path":47,"stem":1169,"description":1170},"04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":5,"path":1006,"stem":1008,"description":994},{"title":1173,"path":954,"stem":1174,"description":1175},"Reachability and Flow Routes","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":575,"path":574,"stem":1177,"description":1178},"04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1180,"description":1181,"path":1182,"stem":1183,"children":1184,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1185,1189,1194,1199,1203,1208,1212,1217],{"title":1186,"path":1182,"stem":1187,"description":1188},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1190,"path":1191,"stem":1192,"description":1193},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1195,"path":1196,"stem":1197,"description":1198},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":43,"path":1200,"stem":1201,"description":1202},"\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1204,"path":1205,"stem":1206,"description":1207},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":48,"path":1209,"stem":1210,"description":1211},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1213,"path":1214,"stem":1215,"description":1216},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1218,"path":1219,"stem":1220,"description":1221},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1223,"description":1224,"path":1225,"stem":1226,"children":1227,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1228,1232],{"title":1229,"path":1225,"stem":1230,"description":1231},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1233,"path":1234,"stem":1235,"description":1236},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1238,"description":1239,"path":1240,"stem":1241,"children":1242,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1243,1247,1252,1257,1262,1267,1272,1277,1282,1287,1292,1297,1302],{"title":1244,"path":1240,"stem":1245,"description":1246},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1248,"path":1249,"stem":1250,"description":1251},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1253,"path":1254,"stem":1255,"description":1256},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1258,"path":1259,"stem":1260,"description":1261},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1263,"path":1264,"stem":1265,"description":1266},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1268,"path":1269,"stem":1270,"description":1271},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1273,"path":1274,"stem":1275,"description":1276},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1278,"path":1279,"stem":1280,"description":1281},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1283,"path":1284,"stem":1285,"description":1286},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1288,"path":1289,"stem":1290,"description":1291},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1293,"path":1294,"stem":1295,"description":1296},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1298,"path":1299,"stem":1300,"description":1301},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1303,"path":1304,"stem":1305,"description":1306},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1308,"description":1309,"path":1310,"stem":1311,"children":1312,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1313,1317,1322],{"title":1314,"path":1310,"stem":1315,"description":1316},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1318,"path":1319,"stem":1320,"description":1321},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1323,"path":1324,"stem":1325,"description":1326},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184886]