Control coverage is the share of systems, users, data, and business processes that are actually protected by a security control. A control may exist on paper, but its coverage is only real if it is deployed, enabled, and working everywhere it is supposed to. For example, an endpoint tool that misses contractor laptops, a patch policy that excludes legacy servers, or MFA that applies only to some privileged accounts all create gaps in coverage.
It matters because attackers look for the unprotected edge of an otherwise strong environment. Limited coverage can leave one unmonitored device, one unmanaged identity, or one exposed workflow as the entry point for phishing, malware, or lateral movement. Defenders measure control coverage to spot exceptions, confirm enforcement, and prioritize remediation. In board reporting, low coverage can make a security program appear stronger than it really is, so good assurance depends on evidence from inventory, telemetry, and exception tracking.