What is MITRE ATT&CK Framework | How Security Teams Use It
Continue Reading
August 20, 2026
CISO vs vCISO explained: cost differences, responsibilities, and when each model fits your business. A complete comparison guide for 2026.
August 18, 2026
Explore the biggest cloud security challenges for GCC enterprises, from IAM gaps to multi-cloud visibility, plus solutions that reduce breach risk.
August 13, 2026
What is secure code review? Get the full process, checklist, manual vs. automated methods, and tools used to catch vulnerabilities early.
The MITRE ATT&CK framework is a free, globally accessible knowledge base of adversary tactics & techniques, built from real-world observations of how attackers actually operate. ATT&CK stands for Adversarial Tactics, Techniques & Common Knowledge, and security teams use it as a shared reference point for describing, detecting, and defending against attacker behavior rather than relying on vague terms like "sophisticated" or "advanced" to describe an incident.
The framework has moved well past its original role as a reference document. In SANS' 2025 CTI survey, 86% of cyber threat intelligence teams reported using the MITRE ATT&CK framework, with threat hunting standing out as the leading use case. That level of adoption is why ATT&CK now functions less like a niche security tool and more like a common language SOC analysts, red teamers, threat intel researchers, and compliance leads all reference the same tactic and technique IDs when they talk about an attack, which is what makes the framework worth understanding in depth rather than just skimming a summary of it.
MITRE ATT&CK is a publicly available knowledge base that catalogs how cyber adversaries actually behave the specific tactics and techniques attackers use at each stage of an intrusion, documented from real-world observed activity rather than theory. The MITRE Corporation built it and has since made it the reference point that most security teams use to consistently describe, compare, and detect attacker behavior.
ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. Each word maps to a layer of the framework: tactics describe an attacker's goal at a given stage (like gaining initial access or moving laterally), techniques describe how that goal is achieved, and "common knowledge" reflects that every entry is grounded in documented, real-world attacker activity rather than hypothetical scenarios.
MITRE, a not-for-profit organization that runs federally funded research centers for the U.S. government, created ATT&CK and continues to maintain it today. The framework began as an internal research effort in 2013, known as the Fort Meade Experiment, aimed at documenting how attackers behaved on Windows enterprise networks after they'd already gained a foothold. MITRE publicly released the first version of the ATT&CK for Enterprise matrix in May 2015, documenting 9 tactics and 96 techniques a fraction of the coverage the framework has today, but enough to establish it as a shared reference point the security community had been missing.
Before ATT&CK, security teams mostly worked from indicators of compromise file hashes, IP addresses, domain names which attackers can change in minutes. ATT&CK exists to shift that focus toward attacker behavior, which is far harder and more costly for an adversary to change than a piece of infrastructure. A phishing email can use a new domain tomorrow. Still, the underlying technique of tricking a user into executing a malicious attachment stays largely the same, which is what makes behavior-based detection more durable than indicator-based detection and why ATT&CK's technique IDs became a shared vocabulary analysts could reference without ambiguity.
MITRE ATT&CK is built from four connected layers tactics, techniques, sub-techniques, and procedures that together describe not just what an attacker did, but why they did it and how.
Tactics represent an adversary's technical objective at a given stage of an attack the goal, not the method. MITRE currently tracks 15 tactics in the Enterprise matrix, spanning the full attack lifecycle from initial reconnaissance through actions on objectives. In the ATT&CK matrix, tactics form the column headers and the fixed structure everything else is organized under.
Where tactics answer "why," techniques answer "how." A technique describes a specific method an attacker uses to accomplish a tactical goal for example, phishing as a technique for achieving Initial Access. Sub-techniques break that down further, since "phishing" alone covers several distinct approaches. The current Enterprise matrix documents 222 techniques and 475 sub-techniques, each carrying a unique ID that security teams reference directly in detection rules, incident reports, and vulnerability assessment findings.
Procedures are the specific, real-world implementation of a technique by an actual threat actor. Together, tactics, techniques, and procedures form what the industry calls TTPs, tying abstract techniques back to documented incidents rather than a general category like "credential dumping."
Beyond tactics and techniques, ATT&CK catalogs the threat groups and software associated with real intrusions. The framework currently tracks 174 groups and 821 pieces of software in the Enterprise matrix malware, custom tools, and legitimate utilities that adversaries repurpose for malicious use, which is where dark web monitoring becomes a useful complement, surfacing early chatter about tools and access before a group's TTPs show up in an environment directly.
The ATT&CK matrix organizes tactics and techniques into a grid tactics run across the top as columns, and the techniques that support each one are listed underneath.
The Enterprise Matrix is the most widely used of the three, covering adversary behavior across Windows, macOS, Linux, cloud, identity, and network infrastructure the backbone of most enterprise cybersecurity platform strategies. It currently documents 15 tactics and 222 techniques, making it the default reference point for SOC teams, red teamers, and threat intel analysts working in standard corporate IT environments.
The Mobile Matrix documents techniques specific to iOS and Android environments, covering how adversaries compromise, persist on, and exfiltrate data from mobile devices. It tracks 12 tactics and 77 techniques narrower than Enterprise, reflecting the more constrained attack surface of mobile operating systems.
The ICS Matrix addresses adversary behavior against industrial control systems and operational technology. It documents 12 tactics and 79 techniques, built around the reality that an attack on ICS/OT infrastructure can affect physical safety and operational continuity in ways an enterprise IT breach typically doesn't.
Each column is a tactic, and each cell underneath it is a technique that can achieve that tactic's objective. Security teams use this layout to assess coverage: for each technique, do we have a detection rule, a mitigation, or visibility into it happening? Mapping detections onto the matrix is the practical starting point for most attack surface management programs.
An attack progresses through a sequence of stages, and ATT&CK's tactics map directly to that sequence.
Initial Access refers to the techniques an attacker uses to gain their first foothold. In Verizon's 2026 DBIR, exploitation of vulnerabilities became the most common initial access vector for the first time, accounting for 31% of breaches overtaking phishing and credential-based access. That shift is exactly why regular vulnerability assessments matter more than ever: an organization defending against last year's most common entry point rather than this year's is testing the wrong assumption.
Once inside, an attacker's next priority is usually staying inside. Persistence techniques maintain access across reboots or credential rotations, while Privilege Escalation moves them from a low-privilege foothold to administrative access. These two tactics often work together in practice, which is a core focus of most penetration testing methods that go beyond surface-level scanning.
Lateral Movement describes how an attacker expands from their initial foothold to other systems on the network, typically using legitimate credentials rather than obvious malware. This stage is often where an incident shifts from a contained compromise to an organization-wide breach.
Command and Control (C2) covers how an attacker communicates with compromised systems from the outside. Modern C2 increasingly mimics legitimate traffic patterns, which is why effective threat intelligence knowing what infrastructure and behavior to watch for matters as much as blocking known-bad IPs.
Exfiltration is the stage where an attacker actually removes data the point at which an incident becomes a confirmed data breach. Attackers increasingly use encrypted channels or legitimate cloud storage to exfiltrate data, which is part of why a domain data breach scan is a useful early-warning check to see whether an organization's data has already surfaced somewhere it shouldn't.
ATT&CK doesn't operate in isolation several other frameworks address adjacent problems.
The Cyber Kill Chain, developed by Lockheed Martin in 2011, breaks an attack into seven linear stages. Where the Kill Chain offers a general overview, ATT&CK provides far more granular detail and isn't limited to a strict linear sequence. The two aren't competitors so much as different altitudes, a distinction covered in more depth in our guide to red team vs penetration testing.
NIST's Cybersecurity Framework operates at a different layer a governance and risk-management model organized around five functions that helps structure a broader governance, risk and compliance program. ATT&CK, by contrast, is behavior-specific: it doesn't tell you how to build a program, but exactly which attacker techniques to detect and defend against.
D3FEND addresses the opposite side of the equation: where ATT&CK catalogs offensive techniques, D3FEND catalogs defensive countermeasures mapped directly back to them. A team identifies an ATT&CK technique they're exposed to, then uses D3FEND to find the specific controls that mitigate it often informing broader zero trust security design decisions.
OWASP and STRIDE operate at a narrower, earlier stage application-layer threat modeling during design and development, the same territory covered by thorough source code review. ATT&CK, by comparison, assumes an adversary is already active in a live environment and focuses on how they operate from that point forward.
ATT&CK gets applied differently depending on the role using it.
Threat hunters use ATT&CK to build hypotheses about what an adversary might be doing inside an environment. Threat hunting is the leading use case for ATT&CK among CTI teams, cited by 77% to 84% of respondents a workflow that pairs naturally with understanding the current cyber security threats most relevant to an organization's sector.
Threat intel analysts use ATT&CK to translate raw reporting on a threat actor into something operational, often supported by dedicated threat intelligence services that track group activity and campaign data continuously rather than on a per-incident basis.
Red teams use ATT&CK to plan engagements around real adversary behavior instead of generic simulations, often emulating the specific TTPs of a threat group relevant to the target's industry the core methodology behind structured red teaming and penetration testing engagements.
SOC analysts use ATT&CK to enrich alert triage by mapping individual alerts back to the broader techniques they represent. This is also where purple team exercises add value closing the loop between what red teams simulate and what blue teams actually detect.
Incident responders use ATT&CK to reconstruct an attacker's path with a consistent vocabulary during incident response, making post-incident reports far easier for other teams, auditors, or regulators to verify than a narrative description alone.
Vulnerability management teams use ATT&CK to prioritize weaknesses based on the techniques attackers actually exploit. Research from UC Berkeley's CLTC found 57% of surveyed organizations use ATT&CK specifically to determine gaps in deployed security solutions the same gap analysis at the core of effective vulnerability management.
ATT&CK's Enterprise matrix breaks technique coverage out by platform.
These three operating systems make up the traditional endpoint coverage inside the Enterprise matrix. Filtering the matrix by platform is a standard first step for teams running enterprise security programs, narrowing hundreds of techniques down to the subset relevant to their environment.
Cloud isn't a separate matrix it's a set of platforms inside the Enterprise matrix, covering IaaS providers and SaaS platforms. Techniques here reflect the reality of cloud attack surfaces, like unusual API call patterns for resource discovery or IAM policy manipulation.
Container platforms have their own dedicated set of techniques, covering behaviors such as container escapes and abuse of the orchestration API itself coverage that's deepened significantly as organizations shift core workloads to containerized infrastructure.
ICS sits entirely outside the Enterprise matrix, built around the constraints of operational technology, where availability and physical safety often outweigh confidentiality. This separation is directly relevant to government cybersecurity organizations managing critical infrastructure, where an attacker's objective is often disruption rather than data theft.
ATT&CK is a knowledge base, not software; the practical value comes from the tools built to apply it.
The Navigator is MITRE's visualization tool for the matrix, letting a team layer detection coverage, red team results, or threat group activity directly onto the tactics and techniques grid.
Atomic Red Team is an open-source library of standalone tests, each emulating a single ATT&CK technique to check whether detection tooling actually catches it. The library currently covers 261 techniques across more than 1,200 tests a lightweight complement to full-scope penetration testing engagements.
Caldera is an automated adversary emulation platform built by MITRE that chains individual techniques into full attack sequences, allowing a team to simulate an entire multi-stage intrusion end-to-end the same principle behind a well-scoped red teaming engagement, just automated.
Both Splunk and Microsoft Sentinel support mapping detection rules directly to ATT&CK technique IDs, letting a SOC visualize live detection coverage against the matrix rather than tracking it manually.
ATT&CK is part of a larger family MITRE has built to cover adjacent problems.
D3FEND is a knowledge graph of cybersecurity countermeasures, funded by the NSA, that maps defensive techniques directly to the adversary behaviors documented in ATT&CK turning ATT&CK's descriptive catalog into an actionable defensive roadmap.
MITRE Engage is a framework for active defense and adversary engagement that uses deception decoys, honeypots, fake credentials to observe and disrupt attackers rather than simply detect and block them.
MITRE ATLAS is a knowledge base modeled on ATT&CK but scoped to how attackers target machine learning and AI systems, inheriting core ATT&CK tactics while adding techniques unique to AI, such as model extraction and prompt injection the same threat landscape addressed by dedicated AI Agentic Pentesting.
Regional regulators across the GCC increasingly expect structured, evidence-based security testing, and UAE cybersecurity regulations broadly reflect that shift. ATT&CK has become the practical backbone for meeting that expectation.
Dubai's Virtual Assets Regulatory Authority requires licensed VASPs to undergo independent penetration testing, and for higher-risk operations, Threat-Led Penetration Testing (TLPT) specifically a requirement covered in detail in VARA compliance. TLPT mirrors the tactics, techniques, and procedures used by real threat actors targeting virtual asset businesses, making ATT&CK the natural reference framework for scoping and documenting that testing. Scope typically spans transaction authorization flows, wallet management systems, and API layers all areas that map cleanly onto ATT&CK's Initial Access, Credential Access, and Impact tactics.
Crypto and fintech platforms operating in the GCC face a threat landscape shaped heavily by identity compromise, API abuse, and front-end manipulation attack paths often uncovered through dedicated smart contract auditing rather than generic infrastructure testing alone. ATT&CK-based threat hunting gives these firms a way to proactively search for early indicators of exactly these techniques, a process detailed further in our VARA VASP assessment roadmap.
Femto Security structures red team and penetration testing engagements for GCC clients around ATT&CK's tactic and technique structure, so each engagement produces a report mapped to specific technique IDs rather than a generic vulnerability list. For clients operating under VARA, this aligns directly with the requirements outlined in VARA cybersecurity compliance services, providing compliance teams with structured testing evidence for regulatory submission. Paired with vCISO for VARA compliance, this ATT&CK-based approach lets clients treat red team findings as part of an ongoing security program rather than a disconnected one-off assessment.
ATT&CK's size can make it intimidating at first the practical path in is narrower than it looks.
MITRE publishes free training directly through the official ATT&CK site, and MITRE Engenuity's ATT&CK Defender program offers additional free training through Cybrary. Building this literacy across a team pairs naturally with broader security awareness initiatives, since a technically fluent team communicates risk more clearly to non-technical stakeholders too.
The most common mistake is treating ATT&CK as a checklist rather than a reference to apply trying to build detections for every technique at once, instead of the handful most relevant to real threats like ransomware or known cyberattacks affecting a specific sector. Beginners also frequently skip validation entirely, mapping a detection rule to a technique ID without confirming it actually fires.
The most effective starting point is to pick one technique that is clearly relevant to your environment and work through it end-to-end. Review the technique page on the official ATT&CK site, check whether existing telemetry captures it, then validate the detection with an Atomic Red Team test a disciplined approach that mirrors how cybersecurity awareness programs build one habit at a time rather than overwhelming a team all at once.
The Cyber Kill Chain offers a general, seven-stage overview of an attack, while MITRE ATT&CK provides far more detailed, granular tactics, techniques, and procedures within each stage. Unlike the Kill Chain's strict linear sequence, ATT&CK's matrix structure accommodates the non-linear, looping nature of real intrusions.
Yes, MITRE grants a non-exclusive, royalty-free license to use ATT&CK for research, development, and commercial purposes at no charge, making it fully accessible to any organization regardless of size or budget.
MITRE releases major ATT&CK updates roughly twice a year; the most recent, version 19, arrived in April 2026 with smaller minor-version corrections released between major updates.
A tactic is the attacker's objective the "why" while a technique is the specific method used to achieve that objective, the "how." Tactics form the fixed columns of the ATT&CK matrix, and techniques are the entries listed beneath each one.
Yes, ATT&CK is increasingly used to structure and document security testing evidence for frameworks like VARA's Technology and Information Rulebook, since mapping test results to specific technique IDs gives a structured, auditable record rather than a narrative report; for broader governance frameworks like ISO 27001, ATT&CK typically complements rather than replaces the standard, providing the technical substance behind controls the standard requires but doesn't itself specify in attacker-behavior terms.