Run your stack against the kill chain.

Pick the security tools you actually run. Pick a named-threat campaign. See in 90 seconds what your stack covers, what's dormant, and what's missing. Real techniques, real MITRE ATT&CK mappings, real peer data.