Definition
MITRE ATT&CK is a globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations, used for threat modeling, detection engineering, and security assessment.
People Also Ask
Common questions about MITRE ATT&CK answered by our security experts.
MITRE ATT&CK in Practice
MITRE ATT&CK is a catalogue of adversary tactics and techniques observed in real intrusions, organised by objective. It has become the common vocabulary between threat intelligence, detection engineering and testing.
Its value is that it is descriptive rather than theoretical. Every technique in it has been seen in use, which makes coverage against it a meaningful statement rather than an abstract one.
Tactics and techniques
Tactics are objectives — initial access, execution, persistence, privilege escalation, defence evasion, credential access, discovery, lateral movement, collection, exfiltration, impact. Techniques are the specific methods used to achieve them, with sub-techniques giving further detail.
The structure matters because it separates what an adversary wants from how they get it. Multiple techniques serve one tactic, which is why coverage has to be assessed at technique level.
Coverage mapping, honestly done
The standard exercise is to map your detections against the matrix and produce a heat map. Done carelessly it produces flattering results, because a detection that would catch one narrow variant gets recorded as covering the technique.
Honest mapping distinguishes full coverage from partial, records what specifically would be detected, and accepts that some techniques cannot be detected with the telemetry available. A map with acknowledged gaps is more useful than a green one.
Prioritising, because you cannot cover everything
The matrix contains hundreds of techniques and most organisations cannot address all of them. Prioritisation comes from which techniques are used against your sector, which apply to the platforms you actually run, and which would be most consequential.
Groups documented as targeting your industry are the practical starting filter, and the framework records which techniques each has used.
Where it is genuinely used
Threat hunting, as a source of hypotheses — walking relevant techniques and asking whether each would be visible. Detection engineering, as the backlog. Purple team and adversary emulation, as the script.
Vendor evaluation, since independent evaluations test products against documented techniques and publish results, which is more informative than a datasheet.
The limitations worth knowing
It catalogues what has been observed and documented, so novel techniques are absent by definition. Coverage of some platforms is deeper than others. And the granularity is uneven — some techniques are narrow and specific, others broad enough that claiming coverage means little.
Keeping a mapping current
The framework is revised regularly — techniques added, restructured and occasionally deprecated — which means a coverage map is a snapshot rather than a standing asset. A map produced two years ago describes a version of the framework that no longer exists.
Treating the mapping as something maintained on a cadence, with a recorded framework version, keeps it usable. Where it is produced once for a presentation and never revisited, it quietly becomes a claim nobody can verify.
Where to start
Pick the ten techniques most associated with attacks on your sector and establish, honestly, whether each would be detected. That short list is more actionable than a full matrix assessment.
See threat hunting. GuardsArm runs penetration testing.
Related Terms
Threat Intelligence
Threat intelligence is evidence-based knowledge about existing or emerging threats to an organization's security. It includes context, indicators of compromise (IOCs), and actionable insights that help organizations understand, prevent, and respond to cyber threats.
Cyber Kill Chain
The Cyber Kill Chain is a framework developed by Lockheed Martin that describes the seven stages of a cyberattack, from initial reconnaissance to data exfiltration, helping defenders identify and disrupt attacks at each stage.
Red Team
A red team is a group of security professionals who simulate real-world attacks against an organization to test its defenses. Unlike penetration testing, red team exercises assess the entire security posture including people, processes, and technology across an extended engagement.
Threat Hunting
Threat Hunting is the proactive practice of searching through networks, endpoints, and datasets to detect and isolate advanced threats that evade existing automated security solutions.
Related Reading
Building a Threat Intelligence Program for Healthcare
Most threat intelligence spending buys feeds nobody acts on. Defining requirements first, choosing sources that match them, and the difference…
Red Team vs Penetration Test: Different Questions, Different Budgets
A penetration test asks what is vulnerable. A red team asks whether you would notice. Most organisations buy the second before they are ready for it.
Threat Hunting in Healthcare: Starting With Realistic Hypotheses
Hunting is not searching logs and hoping. It is writing a falsifiable statement about attacker behaviour and testing it — and in a hospital the good…
Speak With an Expert
Book a free consultation to discuss mitre att&ck for your organization.
Related Services
Need Help With MITRE ATT&CK?
Our certified security professionals can help you implement the right mitre att&ck strategy for your organization. Get a free assessment today.
Book a Free Consultation