Evidence you can re-run yourself.
Every figure on this page is measured by the platform against itself at runtime, not counted by hand into a slide — and each one is stated with the part it does not cover, because a coverage number without its gaps is marketing. You can call the same functions yourself on any deployment, including an air-gapped one. We publish what we detect, what we are blind to, and — for every gap — whether anything could ever close it. The questions are the same ones we think you should put to every vendor you evaluate, including the one we answer badly.
Reading this deployment…
Coverage & Evidence Report — all 17 threat taxonomies
Per public taxonomy · measured by the runtime coverage ledger across all 17 threat & kill-chain matrices (MITRE ATT&CK Enterprise/Mobile/ICS, ATLAS, FiGHT, OWASP Web 2025/2021, API, LLM 2026/2025, Agentic 2026, Agentic+MAESTRO, OAT, CI/CD, plus Fraud, Physical/CV & Insider kill-chains), cited against the tests that prove it · GET /v1/assurance/report
Measuring…
Two distinct coverage planes — threat detection vs. regulatory posture: The 17 matrices above measure adversarial technique detection against runtime telemetry. Regulatory control-mapping and continuous posture across 9 compliance catalogs (CERT-In, DPDP, GDPR, HIPAA, ISO 27001, NIST CSF 2.0, PCI-DSS 4.0, RBI CSF, SOC 2) and 8 statutory privacy regimes are documented separately on Trust & multi-regime governance and For auditors so compliance mappings are never conflated with threat detection percentages.
Why these numbers are lower than the ones you have been shown elsewhere
Because a technique only counts here when a specific detector fires on a specific stream, and it stops counting when we audit it and find the claim was thinner than the label. That has happened repeatedly and the number has gone down on those days — techniques demoted from covered to partial, or removed outright, because the detector was matching something adjacent to the act rather than the act. A coverage figure that only ever rises is not being audited.
Every gap has a reason, and the reasons are different
Adjudication status of every uncovered technique · GET /v1/assurance/report · reading this deployment…
The useful question about an uncovered technique is not whether it is uncovered but why. Four answers, and they carry very different weight if you are deciding whether this platform fits your estate.
Impossible by construction
The act happens somewhere no software on your estate can observe — inside a supply chain before delivery, or in hardware. No amount of engineering here reaches it.
Blocked on telemetry
Detectable in principle, but only from a feed that does not exist yet or that nothing in a normal estate emits. The missing feed is named, so you can tell whether you happen to have it.
Refused on precision
We could ship a detector and it would fire on ordinary work. A rule that pages you about your own backup agent is worse than no rule, so these are deliberate refusals rather than a backlog.
Addressable
The evidence is already on the wire and unread. This is the only one of the four that is a to-do list, and it is deliberately short.
Every gap carries one of these four. The count with no adjudication at all is published beside this heading, whatever it is.
Telemetry Blindness Assessment
What your kind of estate is blind to, and which feed closes the most of it · POST /v1/assurance/blindness
Tell us what you run. Nothing is uploaded, nothing is stored, and no account is created — the answer is computed from the same gap ledger the report above is measured from. There is no single best feed: the ranking is a property of your estate, not of our product.
The Evidence Standard v1.0
Seven questions any security product should be able to answer about itself · GET /v1/assurance/standard
We publish these because we would rather they were asked of everyone. Each names the instrument that produces its answer, so the answer can be re-run by somebody who does not trust us. One of them we cannot answer, and we have left it in.
Answering…
What we point at instead of a case study
Four things you can check without talking to us
The platform runs its instruments against itself
The coverage engine, the rule tester, the backtester and the adversary corpus all grade our own build before they are pointed at anything of yours. The disclosure promises on the security page are watched by our own detection loop, so missing one raises a high-severity alert against us on the same queue an operator would use for anything else.
Coverage is a read, not a document
In a trial you can ask the platform what it covers and get the same figures this page shows, computed from the build you are running rather than the one we shipped a slide about. If the two ever disagree, the deployment is right and the page is stale.
Reports carry their evidence
Every claim in a generated report links to the records that support it, and re-rendering the same data window produces a byte-identical document. The digest is the tamper evidence, which means a report you sent an auditor last quarter can be re-derived and compared rather than trusted.
The build is testable in the open
Nearly every package in the tree carries its own tests, and the trial ships the same binaries we run — so any figure on this page is one you can reproduce on your own hardware rather than take from us.
Scope & Honest Limits Honest limits of this page (4 boundaries) Expand · What EventLake does not do →
- No customers, and no invented onesThere is no deployment in production at a named organisation. We considered writing a composite case study and decided a fictional customer is worse than an empty page.
- Coverage of a catalogue is not coverage of an attackerA fraction of a public technique list is a useful measure of breadth and says nothing about whether the one technique aimed at you next week is in the covered set.
- Detectors need their feedA covered technique is covered when the stream behind it is actually arriving. Coverage measured against our build is an upper bound on coverage in your estate, never a promise about it.
- No independent auditEverything here is self-measured. It is reproducible on your own hardware, which is better than a claim and not the same thing as somebody independent having checked it.
The strongest proof available is the one you run yourself.
Thirty days on your own hardware, against your own events, with nothing switched off. Ask the deployment what it covers and compare its answer to this page.