Quantifying the security posture of an enterprise requires the assessor to state how well each deployed security solution counters each attack technique. Organizations without a dedicated security team cannot verify every entry, so only part of the input is confirmed while the rest is estimated. Existing frameworks weight both kinds of input equally; consequently, when an unverified area is entered optimistically, that area is pushed down the investment priority list. This paper proposes assigning different confidence weights to values confirmed through the enterprise’s own operation of the solution and to values that are estimated, so that the areas genuinely requiring additional security investment are quantified in a way that reflects what the organization actually knows. We derive the true pertechnique coverage of a solution type from public detectionevaluation results, treat it as ground truth, and reconstruct an enterprise situation in which part of the input is unknown. In a five-technique case, the coverage estimation error decreased from 0.44 to 0.30, and under a two-item budget the number of correctly selected investment targets increased from one to two. The method requires no additional measurement and is therefore applicable to organizations with limited verification capacity.

security posture assessment,quantitative security metrics,input confidence,uncertainty,ATT&;amp;CK,investment prioritization