Where the offensive track is thin

Every enterprise tactic is touched by at least one pt-* lab.

36 of 100 ATT&CK techniques the pt-* labs declare are covered by at least one lab.

• Defensive Cybersecurity

  PD-WRL-001 · Protection and Defense

  2/5
  Telemetry queryingDetection engineering · 3Response automationAI and agent securityAdversary emulation · 6
• Digital Forensics

  PD-WRL-002 · Protection and Defense

  1/2
  Evidence handling · 1Protocol analysis
• Incident Response

  PD-WRL-003 · Protection and Defense

  2/6
  Incident triageResponse automationEvidence handling · 1Recovery operations · 1Continuity planningIncident communication
• Threat Analysis

  PD-WRL-006 · Protection and Defense

  1/5
  Telemetry queryingThreat huntingAI and agent securityAdversary emulation · 6Protocol analysis
• Vulnerability Analysis

  PD-WRL-007 · Protection and Defense

  3/5
  Control assurance · 3Vulnerability and patch assurance · 1Offensive testing · 5Asset managementSupply chain risk
• Security Control Assessment

  OG-WRL-012 · Oversight and Governance

  5/9
  Detection engineering · 3Control assurance · 3Vulnerability and patch assurance · 1Recovery operations · 1Audit and control evidenceOffensive testing · 5Identity and access controlData protectionResilient architecture
• Cybersecurity Policy and Planning

  OG-WRL-002 · Oversight and Governance

  0/5
  Continuity planningRisk and policy governanceSupply chain riskSecurity governanceSecurity awareness
• Systems Authorization

  OG-WRL-013 · Oversight and Governance

  0/1
  Audit and control evidence
• Systems Security Management

  OG-WRL-014 · Oversight and Governance

  0/8
  Risk and policy governanceAsset managementIdentity and access controlData protectionResilient architectureIncident communicationSecurity governanceSecurity awareness