What is the MITRE ATLAS heat map?
The MITRE ATLAS heat map shows your organization's coverage of the MITRE ATLAS framework, based on the labs your people have completed. MITRE ATLAS is a globally recognized framework that covers the threats adversaries use against AI and machine learning systems, so the heat map helps you see how well your teams are prepared to defend your AI.
It sits alongside the other framework heat maps in the platform and works the same way. You get a color-coded picture of coverage across every ATLAS tactic and technique, you can drill into any technique to learn what it is and who has covered it, and you can go straight to the labs that close a gap.
It shows coverage, which is what your teams have completed. It isn't a security score or a statement that you are secure.
Before you start
The heat map is available on the Advanced tier.
It's a view for org admins and team managers. If you're an org manager you see your whole organization. If you're a team manager you see a view of the team or teams you manage.
There's nothing to set up. It reads from the labs your people complete, tagged to MITRE ATLAS techniques.
The AI program builder is available on the Advanced tier.
How to view your coverage
Log in and open the Frameworks tab in the top navigation.
Select MITRE ATLAS from the framework dropdown.
The heat map loads. A description of MITRE ATLAS sits at the top, with every tactic and technique laid out below, colour-coded by how much you've covered.
Use the filters to narrow the view (see below).
Click any technique to open its detail panel, then move to the related labs to close a gap.
Create a coverage program
The AI program builder turns your heat map's gaps into a coverage program: a set of labs that targets the techniques with low and medium coverage by default. Low coverage is 0 to 39 percent, and medium coverage is 40 to 69 percent.
Open the MITRE ATLAS heat map. For a more targeted program, use the Whole Organization filter to choose a team or subteam first.
Select Create program, at the top right of the heat map.
The builder creates the program from the gaps in the current view:
With Whole Organization selected and no coverage filter, it uses the low and medium coverage techniques and sub-techniques across your whole organization.
If you've filtered to a team or subteam, it uses that team's or subteam's low and medium gaps instead.
If you've filtered to a coverage level, it uses only that level. Filtering to Low creates the program from low coverage techniques and sub-techniques only. Filtering to Medium creates it from medium coverage techniques and sub-techniques only.
A program isn't built from High coverage only. Programs are built from Low and Medium coverage.
The builder selects labs tagged to the techniques and sub-techniques it includes.
Refine the program if you need to. You can ask for a beginner or intermediate program, set how long it should run and roughly how many hours it should take, or refine it by audience, difficulty, duration, or specific techniques. You can also edit the program directly, or ask the builder to search for more content.
Publish the program.
What you'll see on screen
The heat map
Sixteen tactics run across the top. Under each tactic are its techniques, and some techniques have sub-techniques. Coverage is shown in three colours so you can see at a glance where you're strong and where you're not:
Green: high coverage.
Amber: medium coverage.
Red: low coverage.
Each tactic also shows a rolled-up coverage percentage, so you can spot a weak tactic before you drill into the techniques inside it.
Filters
You can filter the heat map by team and subteam, and by coverage level. Filtering by coverage level is a quick way to isolate what's missing. If you're a team manager, the map is already filtered to your team(s).
The technique panel
Click a technique to open a panel with more detail:
A description of the technique.
Your coverage of it.
Contributors: if you have several teams in view, this shows the top contributing teams. If you have a single team selected, it shows the top contributing people in that team.
A related activities tab, where you'll find the labs tied to that technique so you can close gaps.
Sub-techniques
Some techniques have sub-techniques. You'll see them in a dropdown inside the technique panel once you click into a technique. Each sub-technique has its own related activities.
"No content available"
If a technique shows no content available, it means there are no active labs currently tagged to that technique. It isn't an error, and it isn't something you've done wrong.
How coverage is calculated
A technique counts as covered if anyone in the group you're viewing (your organization, or the team you've selected) has completed an activity tagged to it. Not everyone has to complete it, and you don't have to complete every lab.
Where a technique has sub-techniques, each sub-technique needs its own activity completed, and they roll up into the technique's percentage.
Because some techniques have only a few labs tagged to them, a technique's coverage is often either 0 percent or 100 percent. That's expected, and it's why coverage can move quickly once your teams complete the related labs.
Good to know
You can filter by team and sub-team and see individual contributors within a technique, but you can't filter the whole map to a single person.