In threat modeling, what is the purpose of mapping detections, gaps, and mitigations to a knowledge base of adversary behaviors?

• A. To run automated vulnerability scans.
• B. To manage user access.
• C. To map detections to attacker techniques and identify gaps and mitigation priorities.
• D. To implement encryption standards.

Answer: (C)

Mapping detections, gaps, and mitigations to a knowledge base of attacker behaviors ties defensive signals to how adversaries operate. By aligning what you can detect with specific attacker techniques, you can see not only where detections exist but also where coverage is missing (gaps) and which mitigations would most effectively disrupt those techniques. This makes threat modeling actionable: you prioritize defenses based on the techniques most relevant to your environment, allocate resources where they’ll reduce risk the most, and iteratively improve detection and response as new techniques are added to the knowledge base.

Context helps: a knowledge base of attacker behaviors (for example, a taxonomy of techniques) provides a common language to describe what attackers do, while detections are the alerts you can generate, gaps are the techniques you don’t have good visibility for, and mitigations are the controls you can deploy. This integrated view is what enables focused, proactive defense rather than checking boxes or relying on generic security measures.

While automated vulnerability scans, user-access management, and encryption standards are important security activities, they address different goals. Scans look for software flaws, access management focuses on who can do what, and encryption protects data, but none directly links defensive signals to attacker techniques and identifies where to prioritize improvement based on how attackers operate.