The Enemy at the Gates
Every attack has to pass through a gate, so let’s start there.
I’ve been thinking a lot about defensive control coverage recently and how hard it is to stop the sheer number of attacks that most organisations already can’t keep up with. Yet I still see many orgs fall into the same old trap: using coverage maps to measure defence effectiveness against the MITRE ATT&CK framework.
This is the epitome of a false sense of security.
Everyone colours in the Navigator and reports a percentage. But a coverage map treats all techniques as equally worth seeing, and they are not. Forty per cent coverage concentrated on a chokepoint beats eighty per cent spread evenly, because the adversary doesn’t need to avoid your covered techniques; they need to find one uncovered path. Coverage measures your matrix. Chokepoints are a measure of your paths.
This got me thinking about the many attack paths a cyberattack can take and the least agonising way to identify where multiple attack paths converge and form a kind of chokepoint, making detection and prevention efforts more efficient and impactful. You can’t detect every attack technique, and you can’t shut down every initial access vector; so where should you focus your defensive effort?
Simply put, at the chokepoints. For this article, let’s call them gates. Find the gates, and you will find where multiple attack paths must cross.
Deciding where to hang a span port or an IDS was the same problem back in the 2010’s. You never had enough taps for every link, so you put them where the traffic had to converge. Typically, this was your core L3 switch or even on the firewall.
Chokepoint thinking is network thinking applied to the adversary’s behaviour.
Defining an Attack Gate
For anything attack-centric, I always start with the definitive source of real-world attack techniques, the MITRE ATT&CK framework. The latest update (v19.2 at the time of this writing) includes 918 techniques and sub-techniques across the three matrices (Enterprise, ICS, and Mobile).
That’s a lot of techniques adversaries have at their disposal, and they know defenders cannot stop all of them, but like I’ve mentioned previously in other articles, you don’t need to stop every single attack technique - just the ones specific to you, your industry, your business, your crown jewels. Hint: it’s much less than 918 techniques.
My approach uses three tests, using [insert your favourite LLM here] to analyse against the Enterprise MITRE ATT&CK dataset. For this experiment, I used Claude Fable 5.1.
Test 01 - Multi-tactic residency
The check: Is the technique listed under two or more tactics?
With 222 techniques, 475 sub-techniques and 15 tactics, you can bet there are many. A technique with more than one tactical use is ATT&CK’s own structure, making a convergence point. This removes subjectivity from the equation.
Test 02 - Shared data components
The check: Do three or more unrelated techniques share one data component?
"Data Components identify the specific properties/values relevant to detecting a given ATT&CK technique or sub-technique". - The MITRE Corporation
This is the economics of the argument for focused detection on attack-path convergence. One telemetry source that covers multiple techniques is a big detection win.
Test 03 - Recurrence in threat intel and reporting
The check: Does it (the attack technique) recur across unrelated adversaries in independent reporting and cyber threat intelligence?
Technique adoption among adversaries is a strong signal of attack convergence: different motives and budgets, different targets, same behaviour.
Here are the ten attack gates the analysis produced using the latest MITRE ATT&CK data for enterprise in v19.2
My three main takeaways from this are:
Identity is where correlation pays off. Gate 01 is the only gate visible from five of the six telemetry types. Join the same user across your IdP, domain controllers, remote access and cloud logs, and you get more chances to catch bad actors than anywhere else.
Protect the sensor, not just the coverage. Execution and Credential Access rely almost entirely on endpoint telemetry. If the agent gets killed (gate 05), both go dark.
Network and cloud control-plane logs are independent watchdogs. They serve seven gates each, and neither relies on the host agent surviving disruption.
Some Limitations...
An adversary with valid credentials will skip several gates, highlighting the importance of understanding typical usage patterns and administrative activity. Living off the land (LOTL) collapses Execution and Privilege into typical admin activity. Cloud control-plane abuse compresses the chain so far that gates 02 through 08 barely happen.
A chokepoint/gate everyone knows is one the adversary knows too, which is exactly why BYOVD (Bring Your Own Vulnerable Driver) and safe-mode boot exist. The gates prioritise detection, they don't replace prevention or coverage.
Lastly, heat-mapping ATT&CK is still a useful exercise, and it's how most of us started, because the most-asked question has always been about coverage.
Auditors and regulators alike want to see whether your organisation has an acceptable level of security coverage, and there’s a version of this article that better answers an audit question, but I don’t like audits, and I’d rather focus on the threat-led version, which asks a different one: when somebody is inside your network and moving around, will you see them, and can you stop them before any damage is done?
