Control effectiveness
Prevention is whether the control stopped the behavior. Detection is whether anyone was told. Record an email or MDR result under Your tests and that control’s meter switches to your numbers.
- Prevention, in scope
- 67%
- Detection, in scope
- 54%
Proofpoint Proofpoint
Email gateway · Corporate
Prevention71%Detection66%URL rewrite holds. HTML smuggling in an encrypted archive was delivered, then alerted downstream.
CrowdStrike CrowdStrike
Endpoint · All environments
Prevention84%Detection62%Process injection and LSASS access are blocked. Directory replication from a service account is quiet.
Microsoft Microsoft Sentinel
SIEM · Corporate
Prevention: not measured for this control
Detection58%Detection only. DCSync from svc-backup produced no alert in 15 minutes.
Cloudflare Cloudflare
Web application firewall · Production edge
Prevention90%Detection44%Signature blocks are high. Object-level authorization on the vendor portal is not a WAF rule.
Palo Alto Networks Palo Alto
Edge firewall · Production edge
Prevention74%Detection51%The management interface is still reachable from the WAN on a firmware build with a known issue.
Netskope Netskope
Web proxy · Corporate
Prevention77%Detection49%Corporate browsing is inspected. The finance jump host is exempt for the ERP client.
AWS GuardDuty
Cloud detection · AWS
Prevention40%Detection70%Anomalous API calls alert. A long-lived key that looks like the build role does not.
Claroty Claroty
Plant network · Plant floor
Prevention35%Detection28%The engineering workstation can still open SMB into the cell network.