Abstract: In some embodiments, a method can include identifying detection coverage of a set of adversarial techniques based on telemetry data and a detection instance of an environment. The method can further include determining a subset of detection coverage that has a metric value below a metric value threshold and among the detection coverage for the set of adversarial techniques. The method may further include identifying at least one detection instance associated with the subset of detection coverage. The method can further include presenting, via a graphical user interface, a representation of at least one of the subset of detection coverage or the at least one detection instance associated with the subset of detection coverage. The method can further include updating the subset of detection coverage based on the telemetry data, the detection instance, or the at least one detection instance to improve the metric value.

Abstract: Aspects of the subject technology relate to determining a defense surface change command to be applied to a defense surface. An organizational threat profile is stored and a baseline exposure score for threats is generated. The baseline exposure score is weighted based on at least the organizational threat profile to generate a prioritized exposure score. A defense surface change command is generated based on at least the prioritized exposure score, which is transmitted to hardware or software components, and an updated prioritized exposure score for the one or more hardware or software components is generated.

Abstract: Aspects of the subject technology relate to determining a defense surface change command to be applied to a defense surface. An organizational threat profile is stored and a baseline exposure score for threats is generated. The baseline exposure score is weighted based on at least the organizational threat profile to generate a prioritized exposure score. A defense surface change command is generated based on at least the prioritized exposure score, which is transmitted to hardware or software components, and an updated prioritized exposure score for the one or more hardware or software components is generated.