Security coverage, and why the gaps are always bigger than reported

What is security coverage?

Coverage is the share of assets a control actually reaches. The numerator is easy — your tool reports what it's protecting. The denominator is everything that exists, and no single system knows that.

So "98% endpoint coverage" nearly always means 98% of the machines the endpoint tool already knows about. Assets it has never seen are missing from both halves of the fraction. They don't lower the number; they're invisible to it. The reassuring metric and the dangerous assets are, by construction, disjoint.

Why do security coverage gaps happen?

• Ephemeral cloud workloads. Instances that exist for an hour never appear in a weekly inventory, and can still reach production data.
• Contractor and BYOD devices. Real access, no enrolment.
• Shadow SaaS. A team card, a signup, corporate data in a tenant nobody has audited.
• Decommission drift. Assets removed from the asset register but still routable.
• Silent agent failure. The worst category. The agent is installed, so the asset counts as covered, but it stopped reporting weeks ago. It inflates your numerator with something that protects nothing.
• Acquisitions. A second estate, different conventions, frequently a year behind.

How to measure security coverage

No single source is authoritative. The practical method is reconciliation: pull independent inventories that were built for different reasons and diff them.

• Cloud provider APIs — what's actually running and billing.
• Identity provider — what's authenticating.
• MDM / configuration management — what's enrolled.
• EDR — what's reporting.
• Network and DNS telemetry — what's talking.
• Finance — what's being paid for. Underrated, and hard to argue with.

The union is much closer to the truth than any single feed. The interesting output isn't the union, though — it's each pairwise difference. An asset authenticating against your IdP with no EDR record is a specific, actionable finding. A device billing monthly that nothing has seen in ninety days is another.

How to report coverage metrics honestly

Percentages flatter. Three habits make coverage reporting useful rather than comforting:

1. Report the absolute count, not just the percentage. "99.2% covered" and "41 uncovered production hosts" describe the same estate. Only one prompts action.
2. Age the gaps. An asset uncovered for a day is drift. Uncovered for six months is a decision nobody made deliberately.
3. Track liveness, not installation. Last check-in time, not agent-present. Otherwise silent failures are counted as wins.

Workforce planning has the same failure — see how averages hide shift gaps.

And state the denominator's source on the same slide as the number. A coverage figure without its denominator isn't a measurement.

Security coverage FAQs