User Guide

The Detection Ladder

The Detection Ladder is how SiegePoint Verify grades what your monitoring saw. When we fire a real technique at your environment, we do not ask how far an attacker could get — we ask whether your controls noticed, and how fast. Each fired technique resolves to a single rung, D0 through D4, and carries two timers alongside it. This page explains the rungs, the rule that assigns them, why the ladder runs opposite to the attacker-side Surrender Ladder, and why the timers matter as much as the rung.

What Verify measures

SiegePoint Verify is a detection-validation service in the Breach & Attack Simulation category. It reuses the SiegePoint attack platform — the Mangonel engine, the Authorization Gate, and the ATT&CK-mapped technique library — and inverts the scoreboard. The attack side grades how deep an intruder reaches and halts at the first objective. Verify instead grades whether your monitoring saw each attack, and loops the whole coverage set rather than stopping early. The output is not a pass or fail. It is a coverage map over ATT&CK, and the most useful thing it produces is a ranked list of the techniques your stack could not see.

The five rungs

Every fired technique lands on exactly one rung. The rungs describe increasingly good defensive outcomes, from no visibility at all to the action being blocked outright.

The highest-outcome rule

A single technique can trip several controls at once. It might be logged, alerted, and then blocked. Verify does not report each of these separately. It resolves the technique to the highest defensive outcome it produced. A technique that was logged, alerted, and prevented is graded D4 Prevented, because prevention is the strongest result and it subsumes everything below it. This keeps the ladder honest: one technique, one rung, always the best true outcome your controls achieved against it.

But the rung is not the whole story. Prevention, detection-visibility, and response are partly independent questions, not one scale — a technique can be silently prevented (D4) with no alert, which is good defense and a visibility gap at once. So Verify records the sub-states behind each rung (whether a prevented technique was also logged or alerted) and the report presents prevention, detection-visibility, and response as separate rates; a silent D4 is never counted as "detected." See Reading Your Report.

Why D0 Blind is the most valuable output

It is natural to read the ladder as a scoreboard where higher is better, and for your defenses that is true. But for the report, the low rungs are the point. A D4 Prevented result tells you a control you already have is working. A D0 Blind result tells you something you did not know: an attacker behavior can run in your environment and leave no trace for your team to find. That is the finding that changes what you build next.

Verify ranks every D0 and D1 into a blind-spot list — the prioritized detection-engineering backlog. Each entry is mapped to the log source or rule that would close the gap. The deliverable is not a grade; it is a backlog. In plain terms: here are the techniques your stack is blind to, ranked, each mapped to the thing that would fix it.

The inversion vs. the attacker Surrender Ladder

If you have used the SiegePoint attack side, you know the Surrender Ladder (S0–S4). The two ladders run in opposite directions on purpose, because they answer opposite questions.

The same engine fires the same techniques. What changes is the question being scored. On the attack side, progress up the ladder is the attacker winning. On the Verify side, progress up the ladder is your controls winning.

The two timers: rung says whether, timer says how fast

A rung alone does not tell the whole story. Two additional values are stamped on every fired technique:

• MTTD — mean time to detect: the interval from execution to the first alert.
• MTTR — mean time to respond: the interval from that alert to the first response.

The rung says whether something was seen. The timer says how fast. They are always reported as a pair, because the rung on its own can be misleading. Consider two techniques that both land on D2 Alerted:

• One alerts at MTTD 30s — your team would see it while the activity is still unfolding.
• One alerts at MTTD 6h — the alert exists, but an attacker had six hours before anyone could act on it.

Both are D2. As a defensive posture they are worlds apart. Reading the rung and the timer together is the only way to judge coverage that is genuinely useful versus coverage that exists on paper.

What a rung does and does not mean

Two clarifications that appear in every Verify report:

• Silence is a real result, not an error. When a confirmed technique produces no attributable signal, that is D0 Blind — a finding to act on, not a gap in the test.
• A technique that did not confirm execution is never graded D0. It is reported as inconclusive, because we cannot say a control was blind to something we cannot prove ran. Execution is confirmed before any grade is assigned.

Build status

The Detection Ladder is the grading scheme at the center of the coverage report. For how techniques are fired safely against production, how signals are attributed to the technique that produced them, and how coverage is aggregated across re-runs, continue through the SiegePoint user guide or read the full architecture guide.