MITRE ER7 Explained: From Detection to Operational Efficiency
MITRE ATT&CK ER7 results are often reduced to simple headlines: detection percentages, prevention rates, or “100% coverage” claims. But those numbers alone don’t explain how a security platform actually behaves when an attack unfolds, nor how much operational effort is required to manage it.
To understand the real impact of ER7 results, you need to look at detection efficiency and operational efficiency, not just raw coverage.
This post walks through the key MITRE ER7 metrics and explains what they really mean for MSP operations.
Detection Efficiency: Visibility Without Noise
Detection efficiency is not just about seeing attacks. It’s about seeing them clearly, early, and without overwhelming analysts.
This graph shows the relationship between:
- Detection coverage at the substep level
- The operational side effects: alert volume and detections on legitimate activity
WatchGuard’s results show:
- 100% attack step detection
- 96.5% malicious substep visibility after configuration changes
- Very low alert volume across the entire scenario
- Only one legitimate activity detected, captured as contextual telemetry
The key takeaway:
WatchGuard increases detection depth without increasing noise. Visibility improves with configuration changes, but alert volume and operational complexity remain stable.
For MSPs, this matters because detection that generates excessive alerts or false investigations quickly erodes margins and response times.
Noise and Alert Volume: The Hidden Cost of Coverage
One of the clearest differentiators in MITRE ER7 is that the volume of alerts generated by the products was measured.
Two vendors can exhibit similar detection coverage yet impose significantly different operational costs. Alert volume directly translates into:
- Analyst workload
- Time spent triaging and correlating signals
- Slower response and higher cost per incident
In MITRE ATT&CK ER7, WatchGuard:
- Generates only three high-fidelity alerts across the entire attack scenario
- Alerts remain consistent before and after configuration changes
- Legitimate activity does not generate additional alerts or tickets
Low alert volume is not about missing threats. It’s about correlating activity into clear incidents, so analysts see the full attack story without stitching together dozens of signals.
Prevention Efficiency: Stopping Attacks Without Disrupting Business
Prevention results are often reported as a binary metric: blocked or not blocked. ER7 adds an important dimension by showing whether legitimate activity is blocked in the process.
In the protection test:
- WatchGuard achieves 100% prevention
- Zero legitimate business activity is blocked
This distinction matters. Blocking legitimate activity creates:
- Customer disruption
- Urgent tickets
- Policy exceptions
- Long-term operational friction
Effective prevention must stop attacks early without breaking normal operations. ER7 makes this visible, and WatchGuard’s results show precise prevention with no business impact.
Operational Efficiency: Where Detection and Prevention Come Together
The final ER7 graph brings everything together by comparing detection coverage with operational friction.
This view reveals a critical truth: High coverage alone is insufficient.
Platforms that generate high alert volumes or block legitimate activity can overwhelm security teams, delay response, and reduce the practical value of detection and prevention.
WatchGuard’s MITRE ATT&CK ER7 results show:
- High detection coverage
- Strong prevention
- Low alert volume
- Minimal noise
- No legitimate activity blocked
Together, these outcomes define operational efficiency: the ability to detect, understand, and stop attacks quickly without increasing workload or complexity.
What This Means for MSPs
Across the MITRE ATT&CK ER7 measures, a clear pattern emerges:
- Some vendors maximize coverage but introduce high operational friction.
- Others reduce noise but sacrifice detection depth.
- Only a small subset consistently balances detection, prevention, and efficiency.
WatchGuard’s MITRE ATT&CK ER7 performance translates into:
- Clear incidents instead of alert floods
- Faster triage and response
- Predictable workload per customer
- Security that scales without increasing operational burden
Want the full breakdown?
Download the full guide for a detailed walkthrough of how to interpret the results from an MSP perspective
Visit WatchGuard’s MITRE ATT&CK ER7 website to know more.