Most organisations deploying AI believe they have adequate security controls. Very few can answer the actual question: which MITRE ATLAS attack techniques are those controls actually covering? The Coverage Calculator answers that question with a scored, benchmarked, export-ready report in under 10 minutes.
Evaluate your AI security controls against the full MITRE ATLAS framework. Get coverage scores, gap analysis, prioritised recommendations, and a PDF report. Free, no signup required.
Ask any CISO whether their organisation has AI security controls and the answer is usually yes. Ask them which MITRE ATLAS techniques those controls actually mitigate — and the answer becomes much less certain. This gap between "we have security" and "we know what we're protected against" is exactly what the Coverage Calculator addresses.
The challenge is structural. Traditional security maturity models weren't built for AI attack surfaces. A WAF, EDR, and SIEM might cover 80% of ATT&CK techniques. Against MITRE ATLAS, those same tools might cover 20% — because most AI attacks happen at the semantic layer, not the network or endpoint layer.
Declare which types of AI systems you operate: LLM-powered applications, AI agents, RAG systems, autonomous workflows, or AI-integrated SaaS tools. This determines which ATLAS tactics and techniques are relevant to your environment — a company using only a customer-facing chatbot has a different ATLAS surface than one deploying autonomous agents with tool access.
For each relevant control area, indicate your current maturity level: none, basic, intermediate, or advanced. Controls are mapped to the ATLAS techniques they mitigate — so selecting "advanced prompt injection defences" credits you against AML.T0051, AML.T0054, and related techniques. The calculator uses weighted scoring so that high-risk techniques affect the overall score more heavily than lower-risk ones.
Governance failures are responsible for a significant proportion of AI security incidents — untested systems, missing policies, and unmanaged third-party risk. Step 3 evaluates your governance posture: AI inventory management, security testing cadence, vendor assessment processes, and compliance framework coverage.
Most common ATLAS attack category. Often undercovered despite high awareness.
Retrieval systems introduce unique risks rarely covered by traditional controls.
Fastest-growing gap. Most agent deployments lack systematic security controls.
Sensitive information exposed through AI outputs or retrieval systems.
Model theft, inversion, and adversarial robustness rarely assessed.
Third-party models and dependencies receive the least security scrutiny.
Most organisations deploy AI agents "to try things out" and never formalise permission governance, workflow security testing, or MCP security validation. Agents accumulate permissions and capability with no systematic security review. Average ATLAS agent coverage in assessments: under 30%.
Many organisations have a data governance policy that says access is controlled. Very few have technically validated that chunk-level access control is actually enforced in their RAG system. The gap between the governance document and the technical control is where cross-tenant leakage happens.
Organisations test AI systems before deployment, then have minimal visibility into what those systems do in production. AI attacks are often invisible to traditional monitoring — they show up in prompt logs and output logs, which most organisations aren't collecting or alerting on.
Most AI systems depend on foundation models, external APIs, plugins, and MCP connectors that receive little or no security review. Each one is a potential supply chain attack vector. Most organisations don't maintain an AI dependency inventory, let alone a security assessment of each vendor.
Baseline AI security posture, prioritise investments, and produce board-level risk reporting from the PDF export
Identify specific ATLAS technique gaps in current control design and prioritise remediation by risk weight
Map ATLAS coverage to NIST AI RMF, EU AI Act, SOC 2, and ISO 27001 — the calculator includes framework cross-references
Track AI security maturity over time with repeatable quarterly assessments and trend-visible coverage scores
Not sure which ATLAS techniques matter most for your environment? Use the Threat Explorer to understand each technique — attack paths, real examples, kill chains — before running the coverage assessment.