---
title: Review and Improve Coverage
description: >-
  Identify and address Workload Protection coverage gaps, troubleshoot Agent and
  rule deployment issues, and review detection coverage across your environment.
breadcrumbs: >-
  Docs > Datadog Security > Workload Protection > Coverage > Review and Improve
  Coverage
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Review and Improve Coverage

Use the procedures on this page to reduce blind spots, verify policy alignment, and help Workload Protection detect and respond to threats across your environment. You can incorporate these checks into compliance, CI/CD, and infrastructure reviews.

For information about Coverage views and statuses, see [Coverage](https://docs.datadoghq.com/security/workload_protection/inventory.md).

## Recommended review order{% #recommended-review-order %}

Use this order to review coverage across your environment:

1. Review the full environment to establish a baseline. Validate that resources appearing fully covered have working policies, rules, and Agents to uncover silent failures before addressing visible gaps.
1. Identify unprotected or partially protected workloads, then prioritize resources with the highest business impact and exposure.
1. Verify policy and rule deployment on prioritized resources, and check for outdated or unhealthy Agents on all remaining workloads.
1. Map detection coverage to MITRE ATT&CK, then deploy or update detection rules to close gaps.
1. Reassess coverage to confirm that your changes took effect.
1. Record the final state for compliance, audits, incident reference, and future comparison.

## Coverage widget{% #coverage-widget %}

The widget at the top of the Coverage page shows the percentage of your resources secured with Workload Protection, along with any findings. Use its buttons to investigate unprotected workloads and outdated or incomplete Agents.

{% image
   source="https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_top_widgets.1f074e04b18dc1c5d5980654ecbe54e5.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/security/workload_protection/coverage_page/coverage_top_widgets.1f074e04b18dc1c5d5980654ecbe54e5.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="Coverage page top widgets showing resource coverage, rule loading status, Workload Protection adoption, and Remote Config deployment" /%}

## Find workloads without protection{% #find-workloads-without-protection %}

- View without WP: Hosts running the Datadog Agent without Workload Protection enabled. This opens Fleet Automation, where you can [set up Workload Protection](https://docs.datadoghq.com/security/workload_protection/setup.md).
- View without Agents: Hosts not running the Datadog Agent, which can't be evaluated by Workload Protection. This opens the Infrastructure Catalog.

## Fix policy or rule deployment errors{% #fix-policy-or-rule-deployment-errors %}

To find and fix resources with rule errors:

1. In the Explorer, filter by severity Error, or in the Map, select an Error hexagon.
1. Select a failing resource to open its side panel and review its policies. Policies with failing rules show a status of Error.
1. Review a failing rule's verdict (for example, `syntax_error` or `unknown`) and error message to understand why it failed.
1. [Edit the rule](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md) as needed.
1. Redeploy and confirm the fix in Coverage.

## Find outdated or incomplete Agents{% #find-outdated-or-incomplete-agents %}

- View outdated: Resources running an Agent version older than the minimum supported version (`7.65.0`), which might not support the latest Workload Protection features.
- View incomplete: Resources reporting incomplete or invalid data.

Update or deploy the Datadog Agent, then confirm that the affected resources report complete coverage data.

## Review detection coverage{% #review-detection-coverage %}

Use the Explorer facets under the Rule and Policy groups to filter resources by applied detection content. Filter by MITRE ATT&CK tactics and techniques to see which parts of the framework are covered across your infrastructure.

For information about the MITRE ATT&CK map available in Cloud SIEM or Workload Protection, see [MITRE ATT&CK map](https://docs.datadoghq.com/security/detection_rules.md#mitre-attck-map).

## Confirm that new rules are loaded{% #confirm-that-new-rules-are-loaded %}

You can use Coverage to test and iterate on custom security rules:

1. Write and deploy a [new custom rule](https://docs.datadoghq.com/security/workload_protection/detect_and_monitor/detection_and_finding_rules/detection_rules.md).
1. In Coverage, search for the rule by rule ID, policy ID, or hostname.
1. Confirm that the Agent has loaded the rule successfully.
1. If errors appear, review the verdict, fix the rule, and redeploy.