Reading an ATT&CK Navigator Layer Without Fooling Yourself
A Navigator layer looks like a finished picture of your detection coverage, but the colors are a summary of choices someone made upstream -- here is what to check before you trust the grid.
September 12, 2026 · By ScopeWise Team
What a layer file actually is
An ATT&CK Navigator layer is a JSON file the MITRE ATT&CK Navigator loads to draw its grid. Current Navigator builds read layer format 4.5, which fixes the shape of the file: a name, a domain (enterprise-attack, ics-attack, or mobile-attack), a version block recording the ATT&CK version and the layer format itself, and a techniques array. Each entry in that array names a techniqueID, ties it to a tactic column, carries a color, and optionally a score, a comment, and an enabled flag. Everything the Navigator renders comes from those fields -- there is no hidden computation happening in the viewer, which is exactly why the file is worth reading on its own terms rather than trusting the picture it produces.
Color and score are two different mechanisms
Navigator supports two ways of coloring cells. One is a gradient tied to a numeric score, useful when the underlying data is genuinely continuous, like a percentage or a count. The other is a fixed color assigned per state, useful when the data is categorical. ScopeWise writes fixed colors: covered, partial, not covered, and not applicable each get one color, matching the palette used in the PDF report, so a technique that reads amber in the Navigator reads amber on the page too. This matters because a gradient layer and a fixed-color layer can look superficially similar at a glance but mean different things -- a gradient answers 'how much,' a fixed-color layer answers 'which bucket,' and mixing up the two when reading someone else's layer is an easy way to misjudge what a shade is telling you.
Not applicable is a decision, not a blank
A greyed-out, disabled cell in a layer is not a technique nobody looked at. The convention is enabled:false paired with a comment carrying the reason: either the technique needs a platform absent from the inventory (a derived exclusion) or the customer reviewed it and declared it out of scope with a stated reason. Reading a layer without opening the comment field turns a documented decision back into an unexplained gap, which defeats the purpose of recording it that way in the first place. If a layer you receive has disabled cells with empty or generic comments, that is worth asking about before treating the coverage percentage as final -- a real exclusion and a lazy default look identical without the comment.
Comparing two layers across runs
The useful comparison is two layers from the same estate, generated against the same ATT&CK version, months apart. What changed at the per-technique level is the signal: a cell that moved from not covered to covered reflects a new or improved rule, and that is a real gain worth confirming, not just accepting on sight. But a cell can also change because ATT&CK itself re-mapped a technique between versions, split a technique into new sub-techniques, or revised a tactic assignment -- a shift that has nothing to do with your rules changing. Navigator has a built-in layer-comparison feature that overlays two layers and highlights the diff directly, which is faster than eyeballing two grids side by side, but it still will not tell you which of those two causes produced a given change -- that judgment call is still yours, usually by checking whether the rule set actually changed or only the ATT&CK version did.
Where a quick read goes wrong
A handful of misreadings show up often enough to name. Sub-technique rollup is the most common: a parent technique can render as covered in the grid because one of its several sub-techniques is covered, while the rest sit uncovered -- a detection gap analysis that only counts parent techniques will systematically overstate coverage, so both levels need counting. Revoked and deprecated techniques cause a second kind of confusion: a revoked techniqueID is retired and redirected to its successor, so it will not appear in a current register at all, while a deprecated one is marked not applicable with that reason -- either way, a layer built against an older ATT&CK version will not line up cell for cell against one built against a newer one, and that mismatch is a version artifact, not a coverage change. A third trap is multi-tactic techniques, which legitimately appear in more than one tactic column, so counting the same colored cell twice across columns inflates the picture. And the broadest trap is reading color density as detection quality -- a covered cell means a rule exists for that technique, nothing about whether the rule is well-tuned, current, or would actually fire in a real intrusion.
A worked example
Take a hypothetical mid-size estate assessed twice, three months apart, both runs against the same pinned ATT&CK version. The first layer shows the Lateral Movement and Credential Access tactics mostly red, with a scattering of amber. The second layer shows several of those same techniqueIDs shifted from not covered to partial, and two shifted all the way to covered -- that is the detection gap analysis doing its job, because the underlying rule set actually grew between runs. But the second layer also shows three techniqueIDs in Initial Access that flipped from covered to not applicable, each with a comment reading that the corresponding cloud platform was decommissioned during that quarter. Read superficially, the coverage percentage barely moved between the two layers. Read technique by technique with the comments open, the real story is a genuine detection improvement in two tactics plus a legitimate shrinking of the estate's applicable surface -- two different, both good, developments that a single headline number would have hidden from each other.
What the layer is for
A Navigator layer is a picture of presence: which techniques have a rule, which do not, and which were excluded and why. It is not a verdict on how strong those rules are, and it is not a substitute for reading the gap list behind it. The gap list, ranked by what it says about your exposure, and the detection-strength notes attached to each covered cell are the parts of the assessment that turn into work -- the layer is just the map that points at where to look. See how ScopeWise builds this whole picture, from rule ingest through the layer export, on the MITRE ATT&CK Coverage product page.