What is MITRE ATT&CK?
Glossary
The short answer |
|---|
MITRE ATT&CK is a free, globally accessible knowledge base of adversary tactics and techniques based on real-world observations, maintained by the nonprofit MITRE Corporation. It organizes attacker behavior into tactics, the goals an attacker pursues, and techniques, the methods used to reach them. Security teams use it to describe threats, plan detection and test defenses in a common language. |
How does MITRE ATT&CK work?
ATT&CK is laid out as matrices. Columns are tactics and cells are techniques, many with more specific sub-techniques. Each technique has an ID, such as T1190 for Exploit Public-Facing Application, plus examples of groups that used it, ways to detect it and mitigations. MITRE publishes matrices for Enterprise, Mobile and ICS (industrial control systems), and a related knowledge base, ATLAS, covers attacks on AI systems.
What are the MITRE ATT&CK Enterprise tactics?
Version 20 of the Enterprise matrix lists 15 tactics:
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Privilege Escalation
Stealth
Defense Impairment
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
How teams use ATT&CK
Use | What it looks like |
|---|---|
Prioritizing findings | Fix weaknesses that enable common initial access techniques first |
Attack paths | Show how one finding leads to the next, tactic by tactic |
Detection coverage | Map alerts to techniques and find gaps |
Testing | Plan pentests and red team exercises around real techniques |
Why does MITRE ATT&CK matter for startups?
A small team cannot defend against everything. ATT&CK helps you ask a sharper question: which of our weaknesses would an attacker actually use, and what would they do next? Mapping findings to techniques turns a flat list of vulnerabilities into a story of how a breach would unfold, which makes priorities clearer for engineers and easier to explain to customers.
How NexusVoid handles it
Argus, NexusVoid’s application security product, maps every finding to MITRE ATT&CK and shows attack paths, so you see how an issue in code, a dependency, the cloud or a leaked secret could chain into a real compromise. Risk is then priced in dollars with FAIR, and fixes arrive as pull requests.
Related terms
FAIR risk quantification
Penetration testing
ASPM (application security posture management)
Attack surface management
VAPT (vulnerability assessment and penetration testing)
Frequently asked questions
What are TTPs in MITRE ATT&CK?
TTPs stands for tactics, techniques and procedures. A tactic is the attacker’s goal, such as Initial Access. A technique is a way to achieve it, such as Exploit Public-Facing Application. A procedure is the specific way a particular group or piece of malware carried out that technique in the wild. ATT&CK documents all three.
How many tactics are in MITRE ATT&CK?
As of version 20, the Enterprise matrix lists 15 tactics. Earlier versions had 14. The change came when MITRE split the former Defense Evasion tactic into Stealth and Defense Impairment. Counts of techniques and sub-techniques change with each release, so check attack.mitre.org for the current numbers.
Is MITRE ATT&CK a compliance framework?
No. ATT&CK describes attacker behavior. It does not set requirements or lead to certification. Compliance frameworks such as SOC 2 or ISO 27001 describe controls you should have. Teams use ATT&CK alongside them to check whether those controls would actually stop or detect the techniques attackers use.
What is the difference between ATT&CK and the cyber kill chain?
The Lockheed Martin Cyber Kill Chain describes an intrusion as a linear sequence of stages. ATT&CK is more detailed and not strictly ordered: it lists many specific techniques under each tactic, documented from real incidents, and attackers can use tactics in any order. Many teams use the kill chain for high-level communication and ATT&CK for detailed analysis.
Want to see your findings laid out as real attack paths? Book a call at /contact.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More terms
ASPM
ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.
Attack surface management
Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.
Autonomous CISO
An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.