// GLOSSARY

Detection Gap

A MITRE ATT&CK-aligned, measurable control-visibility matrix for the SOC and Blue Team, showing where attack-path steps are seen and where they are missed by the defense. It is not a list of individual missing detection rules; it is structured evidence of defensive visibility along the attack path. The most valuable output of a red team engagement is not the attack path it found but the map of where the defense stayed blind along that path. Because an attack path can be closed, but the real question is whether the defense will be able to see a similar attack in the future. The detection-gap matrix answers this question step by step: for each step of the attack it asks 'did this behavior produce a log, trigger an alarm, did the SOC notice it', and lays out the seen and unseen steps as a map. Its value is in turning the red team's finding into the blue team's to-do list; each blind spot is given together with a concrete control proposal that would close that gap. So the engagement does not merely say 'the attack succeeded' but 'it stayed invisible at this step and can be made visible with this control'. It is directly connected to the chain-breaking control concept.