A SOC lead is building a quarterly observability review for the security operations platform. They have a MITRE ATT&CK heatmap showing rule counts per technique, an alert-volume trend, and an EPS ingestion chart. Leadership asks a pointed question: 'Which ATT&CK tactics can we currently NOT detect at all, regardless of how many rules exist elsewhere?' Which additional analysis is MOST directly required to answer this specific question?