Detection coverage is the degree to which security controls can observe and alert on specific malicious techniques. It is not a vague measure of “having logs”; it asks whether a known action, such as credential dumping, suspicious PowerShell, or lateral movement, produces telemetry that defenders can actually see and respond to.
This matters because attackers succeed by staying below the visibility threshold. If coverage is weak, an attack can run without generating a useful alert even when monitoring tools are present. In practice, defenders measure coverage technique by technique, using frameworks like MITRE ATT&CK, to find gaps in data sources, alert logic, or analyst workflows. Strong coverage does not mean every event is blocked; it means the security stack can reliably detect, explain, and support response to the behavior being tested.