The Coverage Trap

Editorial note, October 2026: this paper has been withdrawn.

The Coverage Trap argued that control coverage had become the governing unit of OT security investment. Programmes counted deployed controls, and the count said little about whether the exposures that mattered had moved. The paper proposed an alternative built on verified boundaries, relied on in place of much of the ordinary programme.

That conclusion has been revisited. Coverage has real limits, but like an estimate of how likely an attack is, it is the only stand-in available for a reduction nobody can measure. Wherever a wrong answer costs a loss the operation can recover from, the programme it measures is the right instrument. The proposed alternative asked a site to keep every boundary true through every change, which is the discipline of a safety system applied to a whole site.

The question coverage cannot answer, whether an outcome the operator cannot accept is bounded, is taken up in Compliance Has a Working Range.