Each cell in the grid is one MITRE ATT&CK technique (rows = tactics, columns = techniques). Every cell holds a coverage confidence C ∈ [0,1] that decays continuously as the environment drifts — new software, new adversary tradecraft, config changes — exactly the "detection drift" real SOCs fight:
dC/dt = −driftRate · C (exponential decay per technique)
Two things push coverage back up:
- Automated re-tests — every cadence days, a regression-test pipeline re-validates a random subset of techniques (not all — real automation misses edge cases too) and restores their confidence.
- Purple-team validation pass — a full manual emulation + detection-engineering cycle that resets every technique to full confidence at once, at the cost of analyst time.
Meanwhile simulated attacker probes arrive at the configured rate and land on a random technique. A probe is missed with probability (1 − C) for that cell — low coverage means the detection silently fails, exactly the gap detection-engineering programs are built to close. Flashing red = missed, flashing green = caught.
This 2D rebuild renders the same 9×5 coverage matrix as a flat heatmap (color + an in-cell bar standing in for the 3D version's bar height) plus a rolling history chart of average coverage and cumulative missed-detection rate, so cause (drift/cadence/probe rate) and effect (coverage trend, miss rate) sit side by side instead of requiring an orbit camera. The underlying decay, re-test and incident math is unchanged from the 3D original.
Real-world relevance: this is the core loop behind detection-coverage dashboards (e.g. ATT&CK Navigator overlays) and why the "prevent drift" answer — automate periodic re-tests and telemetry health checks — is the whole game: skip validation long enough and coverage silently rots even though nothing in the SIEM ever "broke".