MITRE ATT&CK is a globally accessible knowledge base that catalogs how real attackers operate, organized into tactics, the goals an adversary is trying to achieve, and techniques, the specific methods used to achieve them.
In this blog we will explore everything you need to know about MITRE ATT&CK Framework.
What is MITRE ATT&CK Framework?
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a free, publicly maintained framework that documents observed adversary behavior across the attack lifecycle. It’s not a tool or a piece of software; it’s a structured reference that security teams use to build detections, assess coverage gaps, and communicate threat activity in a standardized way.
MITRE created ATT&CK during internal research in 2013 and released it publicly in 2015. Adoption has been fast and durable since MITRE reports that more than 80% of North American organizations surveyed in 2022 called ATT&CK “critical” or “very important” to their security operations strategy, and that the top 10 Fortune 500 companies, including Walmart, Amazon, Microsoft, and Google, rely on it either directly or through their security tooling.
How Is the ATT&CK Matrix Structured?
The framework is organized as a matrix. Tactics form the columns, each representing an adversary’s technical objective at a given stage, things like Initial Access, Persistence, Privilege Escalation, or Exfiltration. Beneath each tactic sit techniques, the specific methods attackers use to achieve that objective, and many techniques break down further into sub-techniques that describe a more granular variation. As of the Enterprise Matrix’s v18 release in October 2025, the framework catalogs 14 tactics, 216 techniques, and 475 sub-techniques, along with 176 documented threat groups, 784 pieces of adversary software, and 44 mapped mitigations. MITRE maintains separate matrices for Enterprise, Mobile, and ICS/OT environments, since attacker behavior differs meaningfully across those domains.
How Does MITRE ATT&CK Compare to the Cyber Kill Chain and NIST CSF?
Security teams frequently confuse ATT&CK with adjacent frameworks that serve different purposes. They’re complementary, not competing.
| Framework | Purpose | Structure | Best Used For |
| MITRE ATT&CK | Catalog specific, granular adversary behaviors | 14 tactics, 200+ techniques, continuously updated from real incidents | Detection engineering, threat hunting, gap analysis, red/purple team scoping |
| Cyber Kill Chain | Describe the linear stages of an intrusion | 7 sequential phases (Reconnaissance through Actions on Objectives) | High-level attack narrative, executive communication |
| NIST CSF | Guide overall cybersecurity risk management | 6 core functions (Govern, Identify, Protect, Detect, Respond, Recover) | Program-level governance, compliance, risk posture |
In practice, mature security programs use all three together: NIST CSF to structure the overall program, the Kill Chain to narrate an incident at a high level, and ATT&CK to get specific about which techniques were actually observed and whether existing controls would have caught them.
Who Created MITRE ATT&CK and Who Uses It?
MITRE is a not-for-profit organization that operates federally funded research centers, and it maintains ATT&CK as a public resource updated roughly twice a year based on documented threat activity from security researchers, incident responders, and threat hunters worldwide. Because it’s community-informed rather than vendor-owned, security teams treat it as a neutral reference rather than a product pitch. MITRE’s own Center for Threat-Informed Defense extends this work further, partnering with organizations like CrowdStrike, Citigroup, and Fortinet to map ATT&CK against adjacent frameworks such as the CSA Cloud Controls Matrix, closing gaps between compliance-driven controls and how adversaries behave.
How Do Security Teams Practically Use ATT&CK?
The framework earns its keep in a handful of recurring workflows. Detection engineering teams map existing SIEM rules and alerts to specific ATT&CK techniques, which quickly reveals which parts of the matrix have detection coverage, and which are blind spots. Threat intelligence teams translate raw incident reports into technique IDs, letting analysts compare a new campaign against previously observed adversary behavior instead of starting from scratch. Red and purple teams use ATT&CK to scope engagements around techniques relevant to an organization’s actual threat model rather than a generic checklist, an approach covered in more depth in our guide to red team exercises. SOC teams use it during live incident response to name what stage of an intrusion they’re facing, which shortens the gap between “something looks wrong” and “here’s what we do next.”
What Are Common Mistakes Teams Make When Adopting ATT&CK?
The most frequent failure isn’t misunderstanding the framework; it’s stopping at recognition without building a workflow around it. Security teams routinely see ATT&CK technique IDs referenced in threat reports and vendor advisories without a defined process for turning that ID into an actual defensive action, whether that’s a new detection rule, a control adjustment, or a validation test. A second common gap is treating ATT&CK adoption as a one-time mapping exercise rather than a living reference; the matrix is updated regularly as new techniques are observed, and detection coverage mapped against v17 needs revisiting against v18 and beyond. A third mistake is mapping techniques to tools without validating that the control catches the behavior in practice, which is where the framework connects directly into a broader continuous threat exposure management program built on validation rather than assumption.
How Do You Get Started with ATT&CK as a Security Team?
Start narrow rather than broad. Pick the techniques most relevant to your actual threat model, informed by your industry, your infrastructure, and known activity from threat groups that target organizations like yours, rather than attempting to map full coverage across all 216 techniques at once. Use the free ATT&CK Navigator to visualize current detection coverage against the matrix, which turns an abstract gap analysis into something a team can act on in a single sitting. From there, feed that mapping into ongoing detection tuning inside your SIEM and validate it periodically through purple team exercises rather than treating the initial mapping as finished work. Organizations without in-house capacity to run this cycle continuously often extend it through a managed detection and response partner, or layer in identity threat detection and response specifically for the identity-centric techniques ATT&CK catalogs under Credential Access and Lateral Movement.
ATT&CK doesn’t replace a security program. It gives one a shared, evidence-based language, and that’s precisely why it’s stayed the industry standard for over a decade instead of being replaced by something newer.
Not sure how your current detections map against real adversary behavior?
| Connect with our Managed Extended Detection and Response team and run an ATT&CK-based coverage assessment against your SIEM to identify the gaps. |
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
