How to Interpret the Results of the MITRE Engenuity ATT&CK® Evaluations for ICS
Summary: MITRE Engenuity released its 2021 ATT&CK Evaluations for Industrial Control Systems results, presenting vendor performance across four categories - Detection Count, Analytic Coverage, Telemetry Coverage, and Visibility - without declaring a winner or assigning overall scores. Dragos reports the Dragos Platform had the highest Detection Count (156 of 100) and Analytic Coverage (63 of 100), and second-highest Telemetry and Visibility coverage at 93 of 100 versus the top result of 96 of 100.
Why it matters: The evaluation broke adversary actions into 25 main steps and 100 sub-steps, and Dragos' own account shows the adversary defeated two of its four detections for compiled Python executables by moving files over encrypted SSH and placing them in a temp folder named "Rockwell" - a reminder that coverage numbers describe what fired, not what an adversary can still slip past.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026