Vendors claiming 100% coverage against MITRE ATT&CK threats are selling false security. The framework is useful but incomplete. Real threat modeling requires going beyond known detection patterns and consulting actual experts or community tools.
So I will say that, is it in theory something I advocate for? Obviously there are threat models out there, but I think somewhere where I do see the pitfall is I see assessments from certain vendors being like, oh, MITRE ATT&CK, right? We prevented 100%, therefore, you know, we are winning as, as a vendor. And I think that's the mistake where let's say you've modeled something out and you have detections that fit what is already known. Unfortunately, it gives you a false sense of security in a way, and it becomes a sales tactic. So I would pass it off to someone much smarter to myself to say, hey, use this specific toolset or this specific GitHub repo to guide you. But I'm not anti, it just, I think that in a lot of ways it becomes convoluted with sales processes, like a lot of, uh, a lot
