MITRE ATT&CK coverage analysis — identify gaps and track control effectiveness against known threats.