--- title: "Mitigation Efficacy Overview" slug: "mitigation-efficacy-overview" updated: 2026-10-22T15:02:28Z published: 2026-10-22T15:02:28Z canonical: "docs.safe.security/mitigation-efficacy-overview" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.safe.security/llms.txt > Use this file to discover all available pages before exploring further. # Mitigation Efficacy Overview ### **Introduction** Mitigation efficacy measures how effectively security controls reduce vulnerabilities within an organization. By analyzing the relationships between vulnerabilities, ATT&CK TTPs (Tactics, Techniques, and Procedures), and security controls, organizations can identify gaps, prioritize investments, and enhance their security posture. ### **Methodology** The mitigation efficacy process maps vulnerabilities to ATT&CK TTPs and aligns them with the security controls designed to mitigate them. This approach ensures data-driven decision-making for enhanced security. ### **ATT&CK TTP Usage** The system leverages ATT&CK TTPs to establish relationships between vulnerabilities and controls: 1. **Vulnerabilities** are linked to ATT&CK techniques they might enable. 2. **Security controls** are mapped to ATT&CK techniques they mitigate. 3. **Efficacy** is calculated by correlating these mappings. This process creates a matrix that includes: | Category | Details | | --- | --- | | Vulnerabilities | CVEs, misconfigurations, and entry points for attacks | | Techniques | ATT&CK TTPs and related attack methods | | Controls | Security products and configurations | | Weights | Importance scores and prioritization factors | **Key Outcomes** - Identifies areas where attacks are most likely to succeed. - Highlights controls providing optimal coverage. - Enables optimized, data-driven security investments. This ensures a thorough analysis of attack paths, accurate measurement of control effectiveness, and clear identification of security gaps. **Mathematical Formulation** **Technique-Based Efficacy** The efficacy for a mapped technique is calculated as: πΈπ‘‘π‘’π‘β„Žπ‘›π‘–π‘žπ‘’π‘’=π‘π‘π‘Žπ‘ π‘ π‘’π‘‘/π‘π‘‘π‘œπ‘‘π‘Žπ‘™ Where: - π‘π‘π‘Žπ‘ π‘ π‘’π‘‘: Number of controls passed. - π‘π‘‘π‘œπ‘‘π‘Žπ‘™: Total number of controls tested. **Unmapped Efficacy** Unmapped vulnerabilities are those where no TTPs are identified by Balbix AI or third-party data sources. This could result from insufficient descriptions or missing component information. In such cases, Balbix defaults to a conservative, generic calculation: πΈπ‘’π‘›π‘šπ‘Žπ‘π‘π‘’π‘‘=βˆ‘π‘›π‘–=1(𝑀𝑖×𝐸𝑖) Where: - 𝑀𝑖 is the weight (proportion) of technique 𝑖 - 𝐸𝑖​ is the efficacy of technique 𝑖 - 𝑛 is the total number of techniques **Final Efficacy Calculation** The overall efficacy is determined using: πΈπ‘“π‘–π‘›π‘Žπ‘™=π‘šπ‘–π‘›(𝐸𝑒𝑓𝑓𝑒𝑐𝑑𝑖𝑣𝑒 , πΈπ‘šπ‘–π‘‘π‘Ÿπ‘’) Where 𝐸𝑒𝑓𝑓𝑒𝑐𝑑𝑖𝑣𝑒 is: - πΈπ‘‘π‘’π‘β„Žπ‘›π‘–π‘žπ‘’π‘’ for mapped techniques - πΈπ‘’π‘›π‘šπ‘Žπ‘π‘π‘’π‘‘ for unmapped techniques **Integration with MITRE Engenuity Evaluations** To improve accuracy, the system incorporates vendor evaluations from [MITRE Engenuity ATT&CK Evaluations](https://attackevals.mitre-engenuity.org/). This ensures: - Grounding efficacy calculations in real-world data. - Validation against independent testing. - Calibration with vendor claims. ### **Examples and Scenarios** **Example 1: No Vulnerability, No Control** | Vulnerability | None | | --- | --- | | Control | None | | Resulting Efficacy | 0.0 | Explanation: With no vulnerabilities or controls, the resulting efficacy is 0.0. **Example 2: Vulnerability with Matching Control** | Vulnerability | TTP T1190 (Exploit Public-Facing Application) | | --- | --- | | Control Framework | Vendor A | | Control TTPs | T1190 | | Control State | Passed | | Control Stats | 8 passed out of 10 total | | Resulting Efficacy | 0.8 | Explanation: The control directly mitigates the vulnerability, resulting in a high efficacy score. **Example 3: Vulnerability with Non-Matching Control** | Vulnerability | TTP T1190 | | --- | --- | | Control Framework | Vendor A | | Control TTPs | T1110 (unrelated technique) | | Control State | Passed | | Resulting Efficacy | 0.0 | Explanation: Since the control does not address the vulnerability's TTP, the efficacy is 0.0. **Example 4: Unmapped Vulnerability with Controls** | Vulnerability | None | | --- | --- | | Control Framework | Vendor A | | Control 1 | T1190 (Efficacy: 0.8, Weight: 0.3) | | Control 2 | T1110 (Efficacy: 0.6, Weight: 0.2) | | Resulting Efficacy | 0.36 | Explanation: The weighted efficacy of unmapped controls is computed, resulting in an overall score of 0.36. **Visualization** A flow diagram can further illustrate the mitigation efficacy process, showing interactions between vulnerabilities, ATT&CK TTPs, and controls. ### **Conclusion** By applying this methodology, organizations can: - Accurately measure control effectiveness. - Identify and prioritize security gaps. - Make informed, data-driven decisions to strengthen their security posture.