Threat coverage is the range of malicious activity a security control can detect, block, or help investigate. It is a practical way to ask, “What kinds of attacks does this tool actually see?” A product may cover phishing attachments, known malware, suspicious scripts, lateral movement, or abnormal process behavior, but still miss other techniques such as living-off-the-land abuse, encrypted payloads, or identity-based attacks.
In cyber defense, threat coverage matters because no single control protects against every technique. Teams use the term to compare endpoint tools, email filters, network sensors, and cloud detections, and to find gaps that attackers can exploit. Strong coverage does not mean perfect prevention; it can also mean producing useful telemetry for incident response and hunting. Good defenders map coverage to real attack methods, then add overlapping controls so one blind spot does not become a breach path.